A backdoor is not for normal operation. Backdoors like these (when intentional) are for when the device is not functioning as it should, or the user messed up

A backdoor is not for normal operation. Backdoors like these (when intentional) are for when the device is not functioning as it should, or the user messed up the device, and now it needs to be repaired by someone. I'm not defending this practice by any means, as it's a perfect example of why not to do this, but the root user was more likely intended for system maintenance rather than remote viewing of a functioning system. Also, you misunderstand the server component. It's most likely just a name-resolution service that allows the device to phone home to allow connections back through your firewall/router. If they were sucking up all your video data, the latency would be huge, the costs would be exponential for the manufacturer, and it would be a huge point of failure.