Lets look at the facts here potentially a system that we have sold and installed could allow some clever nerdy spotty oik in his bedroom to hack into our customers bank account and withdraw money un noticed, with no chance of anyone finding out it was him? I think this is unlikely but not impossible. Some clever hacker could possibly do it though, the risk of getting caught is high but so is the potential reward.
I think there is a duty of care, potentially a cheap DVR not set up properly is like a trojan horse. The problem as I see it is that Andy has pointed out this fact to us, by rights we should be in the very least informing customers of the potential threat, and advising that they should put there CCTV system on its own VPN. Those of us that fit CCTV thats not already on a VPN.