A worrying report is putting DJI’s Romo robot vacuums under a harsh spotlight, after a researcher demonstrated what looks like a large-scale backend authorization failure.