The next person who does this: please report the config problem to the camera vendor, then make the issue public after 90 days (or other reasonable timeline) if the vendor does not respond. This lowers the chance of future adversaries scraping images of the public from default-open camera feeds.