Usually the factory default WiFi network that IoT devices create during setup is open. No password required. It seems the author left the device in that state w

Usually the factory default WiFi network that IoT devices create during setup is open. No password required. It seems the author left the device in that state when he reverse-engineered the API. So anyone in the vicinity of the network can connect to his lamp and control it. I wouldn't call this "secure."