Maybe it's worse: If these are really off the shelf tablets, presumably the camera can be turned on remotely. Though I'm sure the hotel would have put a piece of black tape over it, right?
Depends on how targeted the attack is. A hacker who is bored and is searching Shodan for what entertainment the IoT is offering might find GPS quite useful.
It's on a private subnet. You'd have to have some way to get onto the hotel's internal network. The one described in the post is being physically at the hotel. Now, there might be other ways, but this most likely isn't about to show up on shodan.
You're right that in this particular case it's not a problem. Nevertheless any type of device that can be connected to a network, will be connected to the internet. Someone somewhere will make it happen.
I doubt the hotel came up with this solution completely by themselves. Whoever installed it will probably install it elsewhere and it's only a matter of time until it goes badly.
