Looks like you read that correctly. Probably shouldn't be too surprising since they are toy helicopters, though you would probably want to close that if you try to run a taco delivery company with them.

Not awfully surprising. It's a toy, not a Predator. Security likely was not a major design concern, and I don't really blame them. Probably even intentional to a degree, to make (owner-sourced) hacking easier.

I was surprised too. Anyone have a video of a drone infecting another drone?

The symptoms of infection should be obvious:

    var actions = [
      function () { up(Math.random() * 2 - 1) },
      function () { left(Math.random() * 2 - 1) },
      function () { turn(Math.random() * 2 - 1) },
    ];
    actions[Math.floor(Math.random() * actions.length)]();