Unless they completely removed Pillow access this should still be exploitable on latest firmware, well except the Remote part that you achieved trough captive portal. There are still ways to access full nativeBridge as far as i am aware
(Though i haven't yet had the time to check the changes made in 5.16.6)