> "Buy this super cheap home automation product” turns into installing an APT in your network.

If that was intention, no need to hide code in the Bluetooth, just write it in the firmware. The device itself it the trojan horse.