One aspect that other commenters haven't addressed is that, if you do publicly disclose, it's likely (or at least possible) that the company would close the hol

One aspect that other commenters haven't addressed is that, if you do publicly disclose, it's likely (or at least possible) that the company would close the hole and remove the functionality that you're currently using, which you might not want. Of course, if you keep the approach private and use it for yourself, there's no guarantee that someone won't find it in the future and either exploit it or report it themselves. Do you feel comfortable having cameras in your house that could (in theory) be accessed silently by an unknown 3rd party?