But between me not having the know-how and any hacking being potentially threatening her health, I never got around to do it. But it would be nice to send a bolus, because the newer smartphone app can't do that via bluetooth.
If I were designing an artificial electronic pancreas like that, I would be super, super paranoid. It's probably one of the few medical devices that I really think should be a strong user of asymmetric cryptography with a challenge-response-challenge-response protocol and multiple independent sanity-checking validation steps at every opportunity. If it can't deliver the bolus it thinks you need, it should alarm loudly and tell you to manually check. If it has a bit flip in the night and slowly drives 255 units of insulin into your bloodstream at 3 am, you won't wake up.
The diabetes community got started on this before the official manufacturers did. Probably in part because the manufacturers were concerned about being 100% bulletproof whereas (some) people living with diabetes were willing to take a bit more risk. And there's a balance around alarms. Some glucose monitoring tech can be frustrating and lead to "alarm fatigue".
Most of the artificial pancreases I'm aware of mitigate some of the risk by rarely sending large boluses at all. They tend to adjust the background basal rate and only send a bolus when you explicitly tell them you've eaten.
The old Medtronic pumps were hacked years ago and Medtronic responded by making it impossible with newer pumps.
By now there are at least 3 different apps on different platforms and they support a variety of pumps.
My next pump will definitely be one that allows remote control and some sort of looping. Whether that's officially from the manufacturer or not.