Recorders exposed to the internet are the real vulnerability
Opening a port so somebody can view cameras from home is the single most common security failure we find on existing systems, usually combined with a default password that was never changed. Remote viewing should go through a secure connection with individual credentials.
