rsync to a NAS locked inside a fireproof safe and keep the combination in a safe deposit box

forget the combination to be invulnerable to rubberhose crypto

Having a replica is an easy part - just host another DVR elsewhere (in a location you own or trust, preferably far away) and stream a copy there at the same time you're streaming a copy to your local DVR. Repeat with more replicas (or a distributed filesystem with relevant properties) for higher resiliency. There are a bunch of distributed filesystem solutions out there to pick from. If you have a hacked but original firmware, most likely it uses a variant of S3 protocol for their cloud recordings, so simple binary patching (replacing hostnames and any hardcoded TLS certificates or fingerprints) may do the trick.

Having a backup power and network is tricky. You need a reliable battery backup that would automatically kick in in case of power outage, notify you about the failure and power all systems that must stay online for a reasonable amount of time. And an one or more alternate network links that would still work if the primary one is severed - e.g. a fiber line and a 5G modem, but the more the merrier.

Insecure firmware is probably not a problem if all devices are strictly isolated away to their own VLAN, which is carefully firewalled away from all your other systems (so even if you get a compromised laptop on your home LAN, it can't reach those cameras without going through a tightly locked down jumphost). Then it is more likely someone's throwing a wrench to a camera than someone hacking into it (even if all it takes is passwordless telnet that gives root access).