Sort of agree, the only "secret" in this case is how long the meter has been up?, I assume they can mitigate the "hack" by just rebooting RF part of the meter randomly? (I only say this because I read they have remote capability to reboot zigbee feature)

I know they stopped accepting zigbee device pairing starting this year, and only allow authenticated API based requests which is delayed by 24 hours. Right now there is no way for customer to get real time data from the meters themselves.