The scenario does not involve "sneaking" in a robot vacuum. It's just another attack vector to pursue when looking to bug a target. Maybe you can't get a 0-day

The scenario does not involve "sneaking" in a robot vacuum. It's just another attack vector to pursue when looking to bug a target. Maybe you can't get a 0-day on their Alexas or their Nests, but you do have one for their vacuum. You remotely update the firmware on the vacuum to exfiltrate the sound that way. Most people didn't realize that the :visited selector represented a danger until someone figured out how to get your browsing history by abusing it.