yes

it's not a remote exploit ota or with bluetooth, requires physical access to the device for a physical hci attack. esp32 devices are not secure against physical attacks anyway.