If you look through the code, you can see that to trigger that error message, the wp_verify_nonce has to return false.
So, you can re-create the issue by opening the page with the file upload on, leave it for 12-24 hours and then try and upload a file. Although these are unlikely conditions, it would seem that this can and does happen; a customer visits your site, views the product, keeps the browser / tab open and then resumes the following day.
It’s not a bug, as you would want the nonces to expire after a given time, but the error message could be changed to be more informative.
The current message reads:
‘Due to security issue, you cannot upload file, please try again.’
The customer cannot try again, as the product attributes, including the file uploader, are then disabled. Not only that, the nonce won’t get regenerated until the page is refreshed.
So, I would suggest that the error message is updated to read something like:
‘You cannot upload the file at this time, please refresh the page and try again. Note that your current option choices will be reset’
It would still cause annoyance to the customer by having to refresh the page and potentially set more a product options, but at least they would have the opportunity of trying again rather than leaving them without a way to continue.