Are cameras on their own VLAN still a risk?
Less of one, but yes. A separate virtual LAN (VLAN) only helps if the rules between it and the rest of the network are strict, and cameras and recorders often get broad exceptions so that staff can watch video from any PC or phone. They also tend to need internet access for apps and updates, which is also a way out for an attacker. Allow only the viewing station or video server to reach the cameras, stop the camera VLAN from reaching everything else, block internet access the devices do not need, change default passwords and update the firmware. A sensor on that VLAN sees their traffic; NetSenX flags scanning, beaconing and unusual outbound volume from them, on every plan, so a camera that starts talking to new places stands out.