Sweden's version of the GDPR does cover cameras. It is illegal to film public places without approval from the police

That is not correct, you just need to follow the GDPR guidelines regarding data handling and legitimate purpose:

https://www.imy.se/privatperson/kamerabevakning/att-vara-personuppgiftsansvarig/

illegal to publish aerial photos of the horizon in sweden for a long time, for security reasons. If you publish a photo of the horizon

https://www.lantmateriet.se/sv/spridningstillstand/undantag/

This ties into the "legitimate purpose" of the previous point: you are not forbidden from publishing photos "of the horizon", but an "aerial photo that goes up to the horizon" is likely to go way beyond any legitimate purpose, also showing your neighbor's property, any nearby public roads with people (aka: personal information) on them, along with any possible strategic infrastructure.

The review process is for strategic infrastructures, but in this case it's a double whammy, where you also need to comply with the GDPR.

I think that part of the problem here was that the person who compromised the cameras was able to robotically rotate them to look at something else. So it's not just what they're aimed at, but what they can be remotely-aimed at that matters for this.