Really valuable research. A benefit to public safety, and drawing attention to a sloppy vendor in the security space, claiming to secure the public, but instead putting the public at risk. However I'm deeply concerned for the researcher and all involved because this may be a criminal violation under the CFAA - accessing these systems without authorization, even if they don't have authentication.