“Anyone can connect to the device at any time and start issuing commands. You can pull activity data, sleep data, heart rate data, menstrual data.”

A $39 smartwatch on the VeryFit app accepts Bluetooth connections from anyone with no pairing code. Anyone nearby can pull heart rate, sleep, and menstrual data or push firmware. The app has over 5 million downloads. Kids’ versions are on store shelves.