So in practice, to exploit this someone would have needed to have been connected to the same local network at some point in time.

Yes, it’s still a vulnerability and Wyze should have actually responded in a reasonable period of time, but this really doesn’t seem like something to lose sleep over.