A researcher remotely accessed thousands of DJI Romo vacuums — including live camera feeds via a PS5 controller — and DJI is paying him $30,000. DJI says it fixed the PIN-stream bug, is patching another flaw and will run audits. How many devices were exposed?