From Unauthenticated API to Grid Risk: A Hybrid Inverter Vulnerability Explained