If the vulnerability is a safety issue, then you could report the issue to various organizations [1] or ask the folks at OSTI what labs would be concerned [2] or ask the UL lab [3] if that device is truly certified given the fire risk you mention. Those routes are likely very slow and would require a lot of patience and tolerance of bureaucracy and double-speak. The words "fire hazard" should get them to look into it.

If that doesn't go anywhere then the only thing that comes to mind would be all the youtubers that test/tear-down inverters and solar arrays. They don't typically cover network security of the devices but maybe they should. Some of them have a lot of followers. If you could get one of the more popular youtubers to test that hardware and also mention their security issues that might pressure the vendor into fixing it.

[1] - https://www.consumersafety.org/resources/report-unsafe-produ...

[2] - https://www.osti.gov/

[3] - https://www.ul.com/services/digital-applications/ul-certific...