On the one hand, if this really is a result of hackers logging in with a re-used password that was found in another companies breach then I don't know what Amazon is really suppose to do. On the other hand, telling the family that and saying "nothing we could have done" seems like a terribly in-sufficient response. I empathize with both parties here, though obviously more so with the family. Maybe Amazon should require 2FA for logging into Ring?
A) We should stop putting devices that are in the home onto the internet.
If you want to have a security camera, keep it limited to the local network only.
B) People need to stop having a default assumption that these are secure. Mentally assume they are public by default, and don't put them in children's rooms for gods-sake!