Giving access when it's not supposed too

Not sure I'd agree with that statement. Personally I see it as the correct credentials were provided, and thus access was granted; ergo, the app performed as intended, and there is no bug.

The error here seems to be around the lack of concern for security; nobody considered that using the same credentials for their fleet of robots could pose a threat if discovered. It's no different to someone using the same email and password for everything, and then wondering why their facebook has been hacked after their Reddit account leaked. The problem isn't a bug in code, it's just poor cybersecurity hygiene; what we see here is the same just on a commercial level.