One idea to allow FreeRTOS to validate interrupt priorities of secure interrupts would be to add secureportEND_SWITCHING_ISR() to secure_port_macros.h. This macro could validate the interrupt priorities because it would run on the secure side at the same interstating depth as the ISR itself (meaning IPSR is still valid).
Existing applications calling portEND_SWITCHING_ISR() (not the new secure version) from a secure ISR would be unaffected. Those applications would continue to function properly, but they would not magically gain validation of interrupt priorities from secure ISRs.
Obviously this is an API change, but so far I can’t think of a way around changing the API. In its own right it’s actually a good API change I think.