If the article reported that the data were being sent unencrypted to a Russian server, would that be considered Russophobia?
The current phrasing is clumsy and reads like a dogwhistle, although I doubt that was the author's intent.
> But if you’re not home, your phone sends the command to a server in China, which then passes the command along to the socket.
> The result is that the unique network ID of your socket is transported in an unencrypted form to the Chinese server — and anyone who gets their hands on the ID can then control the socket.
The problem with tying this to the other security breaches caused by Chinese hackers would actually make this article _more_ sensationalist because that would allege that this company is somehow affiliated with the hacking activity.
If the company and server were located in other countries other than the US, it is highly likely that the author would specify the country as well.