New security camera compromised by worm within minutes of installation

It's still end-to-end encrypted though. Going through their servers it is in case peer-to-peer isn't possible to setup, otherwise it's a direct encrypted link between you and your camera (with client+server certificate validation) without any mediator servers.

Regarding servers vs cameras: To oversimplify; servers can have exponentially more capacity. Either how, in this case, the traffic is encrypted in each end so there's nothing to be done by "the middle man servers", they can't decrypt anything cause they don't possess the keys.

So I'm in the business of wheeling and dealing in these things.

It's common knowledge in the industry that all of these devices likely have government backdoors or (likely deliberate) critical security flaws at any moment.

Virtually all CCTV hardware comes from ruthless and unregulated Chinese markets where the goal is to obfuscate the price (and source) as much as possible, to prevent price discovery by the end user and allow 2-4x markups on the equipment by the integrator.

Usually these manufacturers will sell to separate companies for their name brand, off-brand, and offer custom branding to distributors.

Due to the obfuscstion of manufacturing source, and at the same time a desire to "stand out" amonst the rest, the industry is rife with knockoffs, third-shift products, stolen technology, unauthorized distribution, you name it.

As an example: Every single Hikvision camera on amazon.com is an illegal sale and void of any official support from Hikvision. Go ahead and try to call them with a serial number for a product you bought on amazon and see what happens. It doesn't matter that the company selling the product on amazon is also named Hikvision (its an imposter).

Point being, the surveillance camera market is so rife with corruption that you generally accept that everything is compromised.

But none of it matters, because as long as the features work and the equipment is reliable, you simply throw it all behind an isolated network and call it a day.