Çadırcı reported his findings to the Open Connectivity Foundation, which maintains the UPnP protocol, and the foundation has updated the underlying specification to fix the flaw. Users can check with developers and manufacturers to find out if or when a patch will be available. A significant percentage of IoT devices never receive updates from manufacturers, which means the vulnerability will live on for some time to come.
But you know, it depends on your risk profile. For most people, it's probably fine. Depends how paranoid you want to get.
Binding your VPN connection to qbittorrent is a good idea, for sure, if you use a VPN. I usually keep DHT enabled with a bound VPN connection and a manually forwarded port using Proton VPN. I'm going to try out anonymous mode to see if it affects speeds any, since it looks like it doesn't impact uploads or connections any more. That's a bonus :)