Getting root access because everything runs as root may not let an attacker access any sensitive data they couldn't otherwise have seen, but presumably it makes it easier for them to install their own software and use your camera as a node in their DDOS or spamming network?