It ought to be that reputable retailers in western countries refuse to sell this junk, instead only selling ones they consider secure. Just like they won't sell dangerous toys.
But probably most of these cameras are bought through Amazon, AliExpress or Temu.
This junk controls like 90% of the market though. A lot of it gets rebranded via the OEM/ODM route so good luck finding out who designed the original software.
The Chinese DVR the CCTV installer used doesn't work that way.
In fact it probably has a telnet server with a known, hardcoded root password.