Why would a system that needs to be incredibly secure have exposed IP addresses?

Why can anybody access tens of thousands of home surveillance systems through direct IP? Security through obscurity, failure to properly secure system etc.

A properly hardened system isn't insecure just by exposing a basic log-in screen through encrypted connection.