Completely understand and would love for all the UI’s to use this so I could just expose oh3 over ssl with auth but then that’s unfortunately not an option today as long as I’m not happy with running only Basic UI externally (which I actually might be).
I think folk have been avoiding this by using IPcamera binding to ‘proxy’ snapshots.
I’ve been having the same problem with both direct access and that widget. Right now I’m using that widget to create a mjpeg stream as my current camera does not provide this natively. As the Camera widget spawns a “local server” that you connect to you would run into this with external access anyways. Maybe I’ve misunderstood the entire widget? 
Realized I confused binding with widget in my reply. Still, that widget is more to support credentials and such when creating layouts. Meaning it might be a prereq to get a proxied stream with un/pw to show but it doesn’t solve the problem of the stream needing to be proxied?