Looks like that could be mitigated by just flashing a new firmware. LineageOS (formerly CyanogenMod) has a long list of supported devices these days. Booting something more open source seems like a good idea for a long-running security camera app, as opposed to closed-source stock Android builds.

LineageOS is great, but I doubt it supports many $20 phones. Porting is done by volunteers - people who buy cheap phones are unlikely to make the effort.

Also, in theory a rootkit could go into the embedded firmware or use a closed source kernel module. In fairness, that's not a big threat yet - cheap devices tend to get cheap rootkits...

Not a problem if you plan to wipe and root the phone yourself.