Wireguard is somewhere on my mental todo list for possible replacement of these tunnels, but they do the job and SSH is going to be listening either way to admin the VPS.
The only thing I did to prepare them for that abuse was adding a small adhesive-backed aluminum heat sink [0] to the CPU. It only required some filing of the fins to fit in the tight packaging of the camera enclosure.
I never attempted running them without the heat sink, knowing it was going to be a rough desert life for them. So I can't even say if it was necessary.
It's also possible my software settings which are optimized to minimize wifi bandwidth and storage consumption are helping keep things cool. The `motion` process is only using around 15% CPU continuously, and the loadavg hovers around .27, FWIW.
I just use a cheap VPS like Vultr [2] to terminate persistent ssh tunnels from the cameras and run a self-signed https gateway into them. It's under $5/mo for the cheapest VPS option.
It's a bit of work to get it set up, but nothing crazy hard if you know your way around something resembling a LAMP stack and ssh tunnels. There's no third parties integrated so you control the data and have a lot fewer privacy/safety concerns in general.
If there's no wifi available, at&t offers mobile hotspot prepay service for as low as $25/mo.
[0] https://www.adafruit.com/product/3414
[1] https://github.com/ccrisan/motioneye
[2] https://www.vultr.com/