Worth splitting the two flags, because only one of them is actually doing anything to you.
SameSite is the quiet one. Chrome has treated a cookie with no SameSite attribute as Lax since version 80, and the other browsers landed in roughly the same place, so that cookie is already not travelling cross-site. What the audit is flagging is the missing attribute, not a behaviour difference. Secure is the one with real teeth, since without it the cookie will go out over a plain http request, although on a Shopify storefront you would first need something making an http request to the domain at all, and those get redirected.
One thing I would not try. You can overwrite a cookie from theme JS and add Secure yourself, but only if you match the name, domain and path exactly. localization is set server side, and if your rewrite lands on a slightly different scope you end up with two cookies of the same name, the browser sends both, and the country selector starts reading whichever one comes back first. That is an intermittent locale bug traded for an audit warning, which is a bad deal.
Out of curiosity, did the tool score it as a fail or as informational? Most cookie checkers put missing SameSite in the informational bucket, and that changes how it reads if you are handing the report to a client.