I had a bear like that (not CloudPets, but looks like an exact clone). Thankfully, it was only used by my daughter with my supervision, so I know exactly what has been said. Unless the mic was enabled remotely, that is.

I assumed that the security issues might be bad, but placing the voice on unsecured Mongo facing public Internet is beyond shit.

Thankfully, I have disabled the bear long time ago. But now I worry about my NetAtmo station, which contains an always listening microphone to "measure the noise pollution". Yeah, right.