In general: a fairly common denominator in large scale breaches is the fact that it are not the individual IoT devices (Teddy bears, toys, sensors and what more) that get hacked, but instead the central servers get compromised.
Patches or security updates to the IoT device itself won't resolve that...
Since the individual IoT devices have only limited compute capacity they uplink over the internet to large scale servers and datacenters operated by the manufacturer for their number crunching.
There data from your devices/toys gets sent, associated with your account and profile, and subsequently stored and processed. Often the algorithms processing your data improve when they get to work with more (aggregated) data and neither the stored original data nor such aggregated data will ever be deleted.
Often access to that data proves to be secured insufficiently and when that security gets compromised it is not the data from a single device or user that gets leaked, but from many, if not all customers.
That is the case as well in the article you linked to.
After such large incidents and data breaches you, as an end-user, might get to see updates in the app/firmware/account homepage allowing you to opt-out of such data collection, but typically that comes with a (significant) reduction in functionality, if they device could actually still operate at all without such central data processing.
