My cameras are analog rather than PoE or IP based, but that's just because I set up the initial iteration of the system a long time ago. The standard now is to give your camera an IP address.

With many IoT type things I block access to the public internet. I think with cameras specifically a lot of people even set it up physically on a different network that can only talk to the NVR.

But tldr, basing the cameras on IP invites some of the things in this article. Anyone deploying these devices needs to think about securing them.