If you live in the US that sounds like something the FDA should be notified about. It’s probably not legal to sell a hearing aid that can so easily be hijacked by another party, or if it is, it really shouldn’t be. Either way, FDA regulates hearing aids so they are the ones to complain to.