I agree, especially now that there's a rather comprehensive documentation available online clearly it doesn't require a "tremendous amount of engineering" to hack the device anymore.

It also seems like it would be rather trivial to mitigate this issue in an update, either by securing the BLE connection or by signing and verifying update payloads (or preferably both).