The video streaming is of more concern, but the reporting has been really weird and bad about it. Why do they keep mentioning VLC like it's some secret hacker tool? If unencrypted, why do they mention a shared AES key?
Really wish a reliable source would give more details.
It's a bit confusing, but I think they what they are implying is that there is a total of 65,535 possible keys. Devices may be assigned one of those randomly. The URL must send the key and some sort of device ID. It's possible that if you know the device ID, it would only take 65,535 attempts to gain access to the stream.
Edit: I did miss a key paragraph—they keys are also 16 bits–port enumeration was just the first place my mind went.
It's like saying we pay our interns, but the payment is $0.01 per century. It's not true.