This. You’d definitely want the cameras to have only the public key. If they’re not doing that, then their security must be as bad as their morals because they know people are tearing these down everywhere already anyway.

Of course, not using assymetric encryption makes them more auditable by “third parties” which is an unexpected benefit.

I wonder if they at least use a different key per camera. This would be less necessary for asymmetric encryption, of course, but they don’t seem to be using it. If all the cameras are using the same key, then you can theoretically use the key these people pulled to access data on every other camera as well (possibly remotely if you can remote in somehow).