Amusingly enough, they never actually describe that part as a vulnerability in their blog post. It's a "concern" about a "seamless join process." The word only gets used with regards to the DOS vulnerability, which is only part of the problem. I get the need to at least try and spin things, but it's kind of obvious in this example. And given how people tend to get antsy when they start thinking about possibly being spied on through their webcams, downplaying it is probably counterproductive.