Once the ACL has been changed, the modified security descriptor must be set. The instance returned by Win32_LogicalShareSecuritySetting contains a SetSecurityDescriptor method:
$security | Invoke-CimMethod -MethodName SetSecurityDescriptor -Arguments @{ Descriptor = $aclObject }