Which doesn’t matter about the password. If you have a faulty router which allows unauthorised inbound connections then you have a bigger problem than weak credentials

huh? The camera pokes the hole in the "firewall" (NAT in 99% of cases, which isn't a firewall, hence why it's so easy for bits of software to poke holes in it.

You don't even need to do UPnP, if you're okay with a random port, you can just do STUN.