Doesnt make sense, they either trust Hik or they dont, the camera can be just as much a problem as the recorder, in fact more so because there are more of them. I have found Chinese cameras that report to a cloud, even though they were never set up by the installation company to do so (as far as we are aware)http://2827476.seetong.com/ admin/1234
Now I am no expert, but if the cameras automatically talk to the cloud then, in theory, surely the cloud could automatically talk to them. Cameras are made to stream footage so again what's to stop them doing a ddos attack if given the right command from a cloud.
I am very careful what I install, and how it's installed in government and council buildings.