All Internet traffic is TLS encrypted, except in the case of port forwarding which is strongly not recommended.
Below are diagrams showing security configurations depending on the connectivity method.
Direct to Cloud
Uplink module running on a camera:
Using Gateway
Uplink module running on an on-prem device
Direct ONVIF
Connection over VPN to a VPN IP address of a camera.
Connection using port forwarding and using public IP address and port of a camera
This method is not recommended