A rule of thumb, put your cameras on a separate VLAN and never give that vlan internet access.

Least you can do.