IoT, the S stands for security.
Perhaps the BT connection bridged the device to the internet, but we have no indication of that and the internet was used as the vector. It could have been a local wireless software update interface so maintenance doesn't have to open up each pump to apply the patch.