The i2c over USB with no auth is just way way too common; I've also seen that on a device.