I mean, the speaker part makes sense. The vacuum has a speaker so it can make an alert sound of something's wrong. The most common ones I hear are "please charge Roomba" and "error, please move Roomba" (that'll happen if it rolls over a grate or something and the wheel gets stuck).
Ok so I used to work for iRobot, the OG robot vacuum maker.
Robot vacuums used to vacuum randomly. To make them vacuum systematically, they need to map your house. One cheap way to do that is to use a camera roughly pointing at your ceiling and do Video SLAM. The camera identifies features on your ceiling and how they are changing to know where the robot is and map the room.
I guess ecovac thought they could add a camera feed feature for free since they already had a camera on the robot.
For the non-roboticists: SLAM = Simultaneous Localization And Mapping.
In robot navigation problems we often face the problem to get a grasp of the environment and the robot's position in it. It's easier if there's already a map provided and some sort of external observer who knows where the robot is relative to the map.
Since people don't usually go into your home to map it out and install some sensors in order to locate the robot, SLAM is the way to go. While moving through an environment, a map of the environment is created and by utilzing some fancy techniques based on sensor data like from cameras, mic+loudspeaker, LIDAR or whatever, it is possible to also infer the robot's position.
The problem isn't the video feed per se, it's that the business model of IoT companies, especially cheap IoT companies, include selling off customer data to advertising and other surveillance capital type entities.
So, cheap hardware, lax security at best, and a business model that requires all their devices to have an internet connection to function properly, or access its full feature set.
The unfortunate, actual reason is that people will pay more markup on the vacuum with useless shit added than it costs to add it. Explaining why humans are like this is unfortunately a less tidy and much more disappointing endeavour.
although Ecovacs accounts are password-protected, and a further four-digit PIN code is required to access the video feed, that PIN code is not validated server-side—meaning anyone with the basic know-how of a tool like Chrome web inspector could bypass it