tldr from my skim, the two worst things:

* Probably vulnerable to CVEs that were patched in 2018 and 2021.

* Generates API key to phone home based only on its own MAC address.