There are two different parts of the URL, one is a 4-digit hexadecimal number that has 65,535 possibilities, the other is the 16-digit serial number that has 43-thousand-million-million-million possibilities. The "researcher" was only able to brute force it in 65,535 tries because they had physical access to the camera and were able to read the serial number off the label.