@dalias I mean, it _is_ a vulnerability, just not in _your_ threat model. (Or mine.) They should probably not have included arbitrary memory read/write commands in the HCI. Seems sketchy.
But this isn't going to allow drive-by rooting of your coffee pot or whatever, as far as I can tell.