The embedded Tweet shows that the thumbnails for push notifications are stored on AWS as a secret URL. Thats not great, but also expected for the convenience of having push notifications include media.
The part about VLC seems to be a completely different issue.
> This week, we repeatedly watched live footage from two of our own Eufy cameras using that very same VLC media player, from across the United States — proving that Anker has a way to bypass encryption and access these supposedly secure cameras through the cloud.
The part about streaming from across the United States is irrelevant. Just because can be accessed over the internet doesn't mean it's using "the cloud."
And of course Anker has the capability to access streams. They allow you to login to the app using a username and password and then start streaming from your devices. Them abusing that capability was always a risk.