A significant number of these cameras were bought on Aliexpress and EBay. How are they going to do the recall when they don't even know the end customer?
Aliexpress and Ebay don't ship the products, the sellers do know who the buyers are, at least their name and address.
Ok when I said "they" I meant the manufacturer(s). Look at Samsung and their inability to do a proper recall for the Note 7. A lot of the stores from Aliexpress disappear after one year of existence. I think the proper thing to do immediately is to reverse Mirai and force a password reset on the affected devices.