The best option is just to assume any IPCam is unsafe and firewall them off in my experience; even with a fully open source camera stack connecting it directly to internet is not that great a practice. Put them on a no internet access VLAN and you can largely buy whatever cheap IPCams you want, etc etc. If you want remote access you should expose the server running the camera management software/NVR securely, not the cams.

This is basically how I run Frigate at home today, with only the NVR able to reach the camera IPs on my no web access “internet of nothing” VLAN.