Can’t remember when it came into effect, but randomized device specific passwords are also mandatory in the EU now. This was relatively recently though. It means they single device (item, not model type or class) has to have an individual password (also usually it’s on a sticker or something).

And yes, connecting any ip camera to the Internet is just dumb.