I don't think having credentials stored on the device is all that fatal. The device has to read them back, after all. What they did, however, is much worse: the credentials come from the MAC address. So they're literally broadcasted on every network packet.

The device runs Android, which makes it very simple to use the Keystore system and to store a device specific private key within the TEE or SE where it can't be very easily extracted. If you really don't want to provision in the factory, you could use secure boot measurements to do it remotely. Of course this isn't completely watertight either against a physical attacker, but it would survive a filesystem dump attack and is the least you can do to appear competent.