WebREPL has never been reported to be enabled on a single Blockclock. Because devices are so poorly engineered, with these types of vulnerabilities, and given the loss of trust in Coinkite, users should exit.