One DJI robot vacuum user ended up uncovering a serious flaw in the way the company secured communication with its hardware.
No VPN or exposing ports necessary.