ONVIF and RTSP are different things.
ONVIF is a device and services discovery protocol
RTSP is a video streaming protocol.
ONVIF can be used to discover a camera on a network, query it for its RTSP URL, and facilitate a connection between a client service and the RTSP stream. But you can't stream video via "ONVIF".
I have also found that poor onvif implementations run as root and not as any other user. If you’re sending auth creds, better make sure you have something protecting them on the wire…
And profiles. There are many different feature sets in onvif and just because a camera has onvif logo or compatibility doesn’t mean it will play nice with your gear.
Or ONVIF has a multiple cameras behind a IP, but a crappy ONVIF client only picks one (Unifi Protect).