This isn't enough to attack the pump in that way you'd still have to defeat the pairing step to make the pump accept commands from a transmitter.

Aside from all the technical arguments, why don’t more devices give me clear explicit control (pairing, even if I want to allow remote control) and even better transparent indication of how the device is running

To what extend would you be willing to write down a living will exonerating the manufacturer and be extra clear with your loved ones that you're choosing to take a risk?