I think this is a brilliant little trick, that could help others who have lost or don't know their NVR password, and credit to @Pjlord for thinking it up.
It's almost like using the camera as a trojan horse to attack the NVR.
Plug an inactive camera that has the Hikvision backdoor vulnerability into an NVR PoE port that's in Plug&Play mode - and the NVR just gives away it's password to the camera.
Which can then be tricked into giving up its configuration file...