Ethically? Expire the token since it's compromised, and offer to refurbish all units in the field since flock screwed up, a now all customer data could be poisoned/suspect now.

Realistically? Keep going like nothing happened an make it a customer support problem while pushing new hardened cameras that cost more. Because the product alone loudly flags Flock as a bunch of amoral greedy fuckwits.

I won't suggest ways to actually make their product bulletproof because I care and we don't need to make this problem worse for everyone. It is a tantilizing problem space but there are never any perfect answers in security, only relatively better/worse ones.

One way would be to generate a unique private key on the secure element / TPM and its public key stored on the server for validation. Each API request would need to be signed with a relatively short expiration time. That way the code never contains sensitive content such as an API key, an exploited device only holds in RAM a signed certificate that is valid for a short period of time, and the certificate can be revoked/blocklisted on the server if compromised.

y'all just givin the work away huh? don't answer this unless you are getting paid.