“Luckily it turns out that the required password is sent over plain text! So all I need to do is to sniff the communication between the toothbrush and the head.”
Philips puts an NFC tag in every Sonicare brush head that counts seconds of use and blinks a warning after 21,600 of them. The tag also stores a link to the Philips store. Three wrong password tries and the head locks forever. Philips built DRM into a piece of plastic with bristles so you buy the next one on its schedule.