I have also found that poor onvif implementations run as root and not as any other user. If you’re sending auth creds, better make sure you have something protecting them on the wire…

And profiles. There are many different feature sets in onvif and just because a camera has onvif logo or compatibility doesn’t mean it will play nice with your gear.