I’ve seen two topics touch on this issue, but the updates thing wasn’t really clear to me – at least, I hope.
I distribute ACF PRO in a premium theme abiding by the rules by ACF.
The distributed version 5.x.x has a security issue and ACF releases a patch.
End user is stuck with leaky ACF version because he can’t update.
Offcourse, brighter minds have allready solved this issue….I hope!
You need to update the theme and provide an update to the person that purchased your theme. That or you need to install ACF as plugin so the they can buy their own update license for ACF. There are already things available that let you install required plugins rather than keep them as part of the theme. http://tgmpluginactivation.com/