No need to issue a recall, they could just release a firmware update that disables unauthenticated firmware updates over BLE.