The firefly certainly can transmit it has a display. I imagine an attacker could get the firefly to display enough information to extract the ether from the wallet.
It's a proof of concept, and at least passively interesting. Of course, I didn't see a "decline" button, and without a power button it could be an issue.. btle could be sufficient with a screen sleep.
Also no idea how to add currency to the wallet... that could be another issue.
I saw another diagram of the device where it has two buttons -- one to accept (pay) and the other appears to be a power cutoff switch. I'm thinking that power cutoff will be the payment rejection button.
> Also no idea how to add currency to the wallet
If you get past the crowdfunding page, you are assigned a *.firefly.eth "ENS" name. This corresponds to a wallet address. So, the same way you add currency to any other wallet. (How does it know that it has an available balance, though...)