My understanding is that the password was compromised. It is well within expected behavior for Nest to allow someone with the right credentials to access the connected cameras etc. This isn't a matter of expecting the consumer to reverse-engineer their product and perform a security audit before allowing themselves to trust it, it's a matter of expecting the consumer to understand what credentials are.
