Rule for living: Do not connect a camera in your home to the internet.
...that Hackernoon link pretty much exemplifies all that is stupid in tech journalism. "physical security attack" means "I walked up to his house and cut his cable and if his camera host doesn't scream about that he'll never know" but I'm here to tell ya that any camera that has remote configuration defaults to "hey lost connection to your camera eight microseconds ago" and most of them even have push.
The Xiaomi camera likely uses some dumb cloud to host to. Google undoubtedly does the same. And somewhere in the dumb clouds, something got connected wrong. Certainly shouldn't happen but if I had a dollar, I would guess it's Google sucking at integration.