I've only found out it's a xss, so I have no idea how bad it is... maybe it tricked the admin on running some external script that took over the device?
But if it relies on tricking an admin, that's not a simple thing to just take over several thousand devices
If you have to rely on user interaction, you'd have to attack 10,000 admins or something just to get 1000 devices (unless you're some sort of social engineering genius)
Somebody else suggested that the cameras were just exposing RTSP publicly, and the "hack" was a simple scan to find all the unsecured feeds