The integration registers each camera with go2rtc so Home Assistant can serve a fast WebRTC live view. That is what makes the camera reachable outside Home Assistant too, and this page says exactly how far.

These cameras do not run an RTSP server, so there is no rtsp://user:pass@camera:554/stream for them the way there is for a generic IP camera. They hand out media over WebRTC after a cloud handshake - which is the reason this integration exists at all.

What you can point other software at is go2rtc, which re-serves what the integration has already decrypted.

Each camera becomes a go2rtc stream called aidot_ plus the first twelve characters of its device id:

rtsp://<host running go2rtc>:8554/aidot_<id12>

Read the exact list from go2rtc itself at /api/streams.

Point Frigate, an NVR, or a player such as VLC straight at that URL. It costs the camera nothing extra: these cameras serve a single live viewer at a time, and everything pulling from go2rtc shares the one session the integration already holds. A second direct connection to the camera would not.

By default go2rtc serves that URL to anyone who can reach it. Measured on a live install: from a different machine on the same network, with no credentials at all, /api/streams answered and every camera pulled.

go2rtc can require credentials. In go2rtc.yaml:

rtsp:
  listen: ":8554"
  username: "someone"
  password: "something-long"
api:
  listen: ":1984"
  username: "someone"
  password: "something-long"

and the URL then takes the form you would expect:

rtsp://someone:something-long@<host>:8554/aidot_<id12>

Verified against go2rtc 1.9.14, the version Home Assistant ships. With a live publisher on the stream, from another machine:

One trap worth knowing. go2rtc exempts loopback from that check. Run the same unauthenticated request on the machine go2rtc runs on and it succeeds, whether or not you have set a password - so a check from there tells you nothing. Test from a different machine.

• How far it reaches is go2rtc's setting, not this integration's. go2rtc binds its RTSP port on all interfaces unless configured otherwise, and Home Assistant's bundled go2rtc and a standalone one differ. If you would rather not use credentials, bind it to loopback or firewall the port.
• A stream carries media only while the camera has a live session. With the default Mains camera warm-hold of 0 (always warm) a mains camera holds one continuously, so its stream is pullable around the clock. Give it a positive warm-hold and it carries media while someone is watching plus that window afterwards. Battery cameras are only live on demand.
• The integration's own serve is loopback only. It listens on 127.0.0.1, and the underlying library warns if decrypted media is ever served on an address that is not loopback. go2rtc is the part that reaches the network.

No. Registering the camera with go2rtc is how the WebRTC live view has always worked here, whichever streaming mode is in use - it predates the direct publish option. It had simply never been documented, which is the only thing that changed.