I'm also not sure that creating a hoax device with the intention of surreptitiously recording individuals that also damages their property and releases a chemical agent would be considered strictly "a security camera".
There can likely be no expectation of privacy trespassing on someone else's property.
but, for the package. Can you have an expectation of privacy when opening an unknown-thing? The device isn't recording until it is opened. I could see logical arguments on both sides. But, since the audio/visual recording doesn't start until they open the thing it might be on the safe-side of wiretap laws?
Recording audio without two-party consent in my state is illegal and only just recently were there any court cases where recording police officers without their knowledge wasn't prosecuted as wiretapping.
Booby traps causing injury are illegal everywhere.
Calling a smell a "chemical agent" is just inflammatory. Everything is a chemical, sure, but there is no chemical reaction involved here. Would you call perfume a "chemical agent"? It's just something that smells bad.
The only danger would seem to be getting glitter in their eyes.
If someone designed a trap to spray perfume on an unsuspecting person, I would describe it similarly.