I think a starting point to avoid such things even if one does not use Zoneminder would be to look at their hardware compatibility lists [1] and ask on their forums [2] to find stand-alone cameras and keep them on an isolated network using a layer-7 proxy such as HAproxy [3] to reach your management interfaces so they do not have a gateway but you can still access your devices.

The forums of all the assorted open source NVR's would also be a good place to share your findings. Zoneminder, Shinobi, Frigate, etc... I mentioned Zoneminder as they are used by a number of corporations and requiring an outbound connection to a 3rd party would be a show stopper for many of them so this topic should be a shared concern.

[1] - https://wiki.zoneminder.com/Hardware_Compatibility_List#IP_C...

[2] - https://forums.zoneminder.com/

[3] - https://www.haproxy.org/