Perhaps you're unaware that an earlier edition of this product had a bug that made the device randomly speak with a terrifying satanic voice. My niece experienced it first hand

I had one when I was a kid. Hilariously it did the satanic voice after I threw it against a wall. Didn't do that again.

Not a bug. Working as intended.

I had no idea about that!

I agree, especially now that there's a rather comprehensive documentation available online clearly it doesn't require a "tremendous amount of engineering" to hack the device anymore.

It also seems like it would be rather trivial to mitigate this issue in an update, either by securing the BLE connection or by signing and verifying update payloads (or preferably both).

Even putting aside malicious use, which sounds hard, bricking the toy with a bad firmware patch sounds doable.

“Mooooom! Jane killed my furbie with an exploit!”

This is the cyberpunk future reality that the science fiction authors missed the ball on :)