Linus Tech Tips with his Dunning-Kruger effect once again.
They upload the data required for mobile notifications to a CDN, which any one of us would likely do.
The other half of the controversy is that they upload a facial identifier for the same notification... if you have facial recognition for notifications turned on.
The hook-up has a more informed take on the issue: https://youtu.be/a_rAXF_btvE. I'm not sure if he was previously a software engineer, but he certainly seems to understand the problem Eufy faced like one.
My take-away is that they should have been more transparent about some form of upload being an unavoidable reality for mobile notifications in their marketing material.