It's exactly as (un)secure as I expected. It's a wireless device made by bike part manufactures... can't expect better, realistically.
Still, I wouldn't recommend someone against buying one because of this. The threat model for cyclists is getting maimed by vehicles or psychopaths laying booby traps out there. Hackers messing with my gear shifting is the least of my worries.
Welp, at least it's a non-profit and the amount of people under care is increasing.
I'd say this kind of thing is in the best 1% of UCP moments, considering everything else. It's a low bar but still.