For one thing, never use these things' cloud service. Rather assume they have bad security and take measures to use them better. I make sure mine has no access out the firewall and its certainly not exposed. I use a vpn into the firewall and access the DVr via the app through that.
I noticed early on that these things communicate with external servers even when you turn the cloud service off. Nasty little things.