All surveillance cameras have admin/admin as a default login and nobody ever changes it. It's also fairly easy to sniff a network and find out what devices are IPcams. Often, some server will host all the IPs and it'll be leaked.
Combining these two, you got essentially open access cameras all around the world.
t. works with surveillance cameras