I can't speak to this design specifically, but in the US, an app like this should _request_ a time slot for crossing, which would get processed by the timing controller. An attacker could use long range bluetooth antennas to pair at a distance, and request for the next 3 intersections, the high tech equivalent of pushing all the buttons in the elevator.

Hopefully the publicly exposed API call into the traffic light network is "I am old, at [x]", not "Set traffic light time to [n] at [x]". Hopefully.

"ISIS recruits disabled people to attack transportation infrastructure" would make some good clickbait.