Imo other related code of the person who made that mistake should be audited, could be there is similiar mistake somewhere else.
Additionally imo possible that some developers would intentionally make such mistakes to sell these to interested persons, there are millions to be made here.
Maybe easy fix would be some certification requirement for routers that by default ports to device are closed even from same network?
Some time ago there was issue with default passwords and it got solved with default passwords unique to device.
USB-C is awesome. Quite cheap (40€) 20000 mAh Xiaomi power bank can output 20V/45W so I can use it to charge my T480s.
Also bought cheap usb-c Power Delivery modules (can output 5/9/12/15/20V) which I used to provide power for my TS100 soldering iron. Combined with the power bank it's now a portable soldering iron. TS80 has usb-c even built in, no module needed.