I'm not sure whether the doorbell uses the same Tuya platform as their vacuum cleaners do, but if they do then there's a major vulnerability there - essentially all their Tuya-based devices can be accessed by knowing just a (sequential) ID.
I've got some code that implements the "request signature" mechanism (the missing piece of the puzzle in the above issue) that might make this more obvious - you'll notice that the TuyaAPISession class only takes a username (the aforementioned sequential ID) and country code, no password (as it's hardcoded and the same for everyone): https://gitlab.com/Rjevski/eufy-device-id-and-local-key-grab...