As someone who has worked with Chinese made IoT devices, I have seen this problem many times. The issue is a bad architectural design of the system where a camera is “bound” to a user account and even if the user returns that camera it’s still bound to their account, and adding it to another account afterwards doesn’t disassociate it from the other user. It’s just stupid things like this that are not well thought out that pop up in the multitude of cheaply made Chinese IoT problems that have flooded the market.

Believe it or not, this is the smallest security flaw in some of these systems/devices...