Once the ACL has been changed, the modified security descriptor must be set. The instance returned by Win32_LogicalShareSecuritySetting contains a SetSecurityDescriptor method:

$security | Invoke-CimMethod -MethodName SetSecurityDescriptor -Arguments @{ 
    Descriptor = $aclObject 
}