The new user from the ONVIF guide has administrative access (security issue)

[MikeVRT]

I'm not sure about right choice of sub-project. Please move it to firmware if it fits better there.

The user, created with that guide for ONVIF has WebUI administrative access.

The simple solution, from my point of view, is:
It may be better to allow only users in a special system group to log in to the WebUI.
For example, the root user is in the wheel group by default:
uid=0(root) gid=0(root) groups=0(root),10(wheel)
This 'marker' could be easily used as a condition to determine whether a user could access the system as root or just as an endpoint consumer. Just a simple check in the WebUI authentication code and an 'Access Denied' message if the user is not a member of the "right group".