I don't have a Nest but I suspect it's even simpler than that. She didn't have a subscription but the devices still store video locally up to the capacity of onboard storage. These recent local clips used to all be locally accessible but to "increase subscription value", Google started making that locally stored data inaccessible without subscription.

However, the local storage is just a rolling buffer and the clips beyond the last 10 seconds are still there in local RAM and either not shown in the interface or deleted in the file system (but just by blanking the name in the directory, not a secure overwrite erase). Either the FBI forensic data recovery people or Google/Nest finally ran a sector-by-sector file recovery. I'm just surprised it took so long. I assume maybe because the local storage on those doorbells isn't a removable SD card so they had to gain access some other way.

Frankly, I'm surprised how many people buy devices which are cloud-only. At this point, I generally won't consider any IOT devices if the manufacturer even offers an optional cloud subscription (unless the firmware is open source). Too many companies have now locked down previously open devices to force cloud subscription (looking at you Chamberlain/LiftMaster assholes).

EDIT TO ADD: Saw this Verge article by someone who bothered to find out how current Nest doorbells work. It basically confirms what I thought with the nuance that some local files actually get uploaded to the cloud even without a subscription but aren't accessible until the user pays. https://www.theverge.com/tech/877235/nancy-guthrie-google-ne...