These systems are often air-gapped in theory, but connected to the internet in practice—usually via a forgotten DSL line or a 4G dongle left over from a contractor.
Manufacturers often use a standardized directory structure across thousands of devices. If a camera model is configured to serve its video feed at /view/view.shtml , an attacker does not need to guess the IP address and port alone; they can simply ask a search engine to index all devices that contain that specific path. inurl view view.shtml