Even putting aside malicious use, which sounds hard, bricking the toy with a bad firmware patch sounds doable.

“Mooooom! Jane killed my furbie with an exploit!”