A good chunk of ip cameras come with an easy default password which is the same for all models. It usually is something like
The basic customer doesn't know that millions of ip are being scanned every seconds and that their ip camera will be discovered in minutes if not in seconds. Thus, the basic customer often does not change the default password.
Why are most ip camera manufacturers, which obviously know those fact since it's their business, not setting a different randomly generated password for each camera ?