Network isolation, unless it's true airgapping (and then lack of remote access is a feature), relies on router not forwarding traffic where it shouldn't go.

Same goes for NVR or intermediate hub(s) (if NVR is somewhere outside of one's premises). They should only accept what they need and know how to handle, and reject anything else.

Those Eufy homebases are just poorly designed, that's all.