The security threat is real, they got ddos attempt to their mqtt service last year from 3rd party apps.
The fix is not good though, distributing private key.
I genuinely don't understand how these changes could possibly protect them from ddos though — their cloud APIs are still public, and the Bambu Connect app has to do stuff there as well. What could've changed with the proposed changes?