[sudobash1]

It looks like OpenIPC is a replacement firmware. I would assume this means (as long as you trust the OpenIPC authors) that you don't have to firewall them off from the Internet. You ordinarily only have to do that for the sketchy firmware that they come with. Open firmware shouldn't be "phoning home".

[ck2]

You never know when a zero-day is going to popup and whack your cameras as IOT, part of a DDOS or whatnot

But if you've hardened it even a little bit with something as easy as not letting it communicate off your intranet, well that can prevent ugly discoveries later

If you need offsite remote camera access you can always carve out a tunnel