Using 3D Printers for network persistance

Myself and my team have been working on security issues with 3D printers and have found them to be trivially hackable. We recently purchased a Mars 5 Ultra resin printer to test and was horrified by how unbelievabley quickly I was able to hack into this device.

By default, and on the latest firmware (at time of research):

they expose port 3030 on the printer and without any authentication I have complete read access to the file system of the printer. Running as root! 

As I am running as root I am able to access every file and binary, but what is worse is looking at /etc/shadow root is the ONLY account running and with a static password (no salt):

And all this over an unencrypted protocol. 

Additionally as they are running a SAMBA server which is how you send and receive files to the printer; also running as root, it was trivial for me to replace one of the sbin binaries with an implant and get a reverse shell to take complete control of the printer. 

In total it took me 19 minutes from start to finish (including generating the reverse shell) to take complete root control of the printer. 

I cannot imagine Elegoo are the only ones like this. I did go through responsible disclousre and notified Elegoo of the issues as well as some pretty straight forward and basic recommendations. There response was alonge the lines of "Great thanks! [Thumbs up emoji]"

Curious what you guys all think of this... if this was a router or switch or some other consumer (are 3D printers considered consumer products? pro-sumer? I don't know...) product then it probably would get a much bigger reaction. But devices like knock-off FireTV sticks, dodgy IoT devices, shoddy web-cams, etc create nice cozy places for backdoors to live in networks. And as these printers can be found in engineering companies, Universities, etc as well as peoples homes... I feel like the bar should be ever so slightly higher...