If the bed requires going through some kind of production endpoint interaction in order to set up the remote connection (as is most likely the case), then his claim that any engineer can connect to any bed is simply false, and this is no more of a security hole than the idea of having a cloud-connected bed which is updated OTA in the first place.