The generation of SOAP messages using the Flash plug-in enables the attacker to avoid the problem of password authentication, and the fact that many home routers are configured to accept SOAP messages without any type of authentication compounds the threat.
Naturally as we move away from the world of programmers it becomes less beneficial to have configuration in code. Why? Because non-programmers can't manage the configuration. In this case what you'll probably really want to do is to provide a UI for configuring your code.