In short, L2 communication can be just as secure as L3. Period.
If we go by your logic, then (almost) everything networked is hackable - and this, unfortunately, is the sad truth, whatever the OSI layer or protocol. I am well aware of that and consider myself security-conscious (which proved to be very helpful many times). The questions are usually: the worth (of hacking), complexity, and time (which is money). In this case the worth is low and we can choose a security model accordingly.
I stressed out the importance of the implementation - and it should contain at least the same level of "security" as the config web page (or the Windows application protocol for that matter) of the current firmware has. Which is, sadly, nothing. Right, nothing is preventing someone on the same IP network (which can be set up freely in seconds on an adversary device) to alter settings. Everything I suggested is already better, or more secure than this. HTTP calls are a simple matter, just as is finding the device on the network. The web page is just for us human beings. Adding this functionality (however unlikely) would not weaken the security of the device. Oh, you're right, it's not "unhackable" - but you already get my point. The aim cannot include the utmost security this time.
The alternative ways like pushing a button at power up or such things no doubt would be just as good even if slightly less convenient. But we don't even have that now.