Calling an STM32F407 absurdly over-specced is hyperbole. It's just a 6$ micro controller, not a smartphone class SoC like a Snapdragon. They probably need it to do the QR code scanning and IoT DRM thingies.