I think it's perfectly fine to boycott a company for unethical practices. I'm actually for boycotting them for ethical reasons. I dislike how security gets muddied with ethical things. People dislike a company and then throw whatever they can at them to see what sticks.
I read the report, it states:
> There is no direct evidence in the public domain that Hikvison or Dahua provide data to the Chinese state or that their security vulnerabilities are exploited by Beijing.
They are insecure anyway, with many exploits discovered, but a quick search tells me that is the case for many CCTV cameras. The takeaway should be that all CCTV cameras are insecure and should be setup in private networks with no access to the internet. The security should be happening at a different architectural level regardless of who the supplier is.
The choice to boycott a supplier for ethical reasons should be separate. Just my opinion of course.