Context: Hole Punching is one of NAT traversal techniques. It was first designed for P2P applications where the two peers are both behind the NAT. In the context of IoT, this technique is implemented by some connected IP cameras to allow users to control their devices remotely through an intermediary cloud server (figure).
Source of the figure.
Question: What are flaws or vulnerabilities in this technique that a hacker may exploit to remotely attack an IoT deployment (e.g., Smart Home)