Do I understand correct that whenever a user enters a host he/she gets direct connection with every camera and drone slaved to the host BUT the user doesn't get any video/audio traffic from these devices?
Correct.
(note that 'direct connection' is not the same thing as DNI).
With a 'direct connection' (either by being inside the host a device is slaved to or by using a cable between your cyberdeck and the universal access port of a device) a hacker get to ignore master ratings when trying to place their marks the device. And there is also no noise (and in the case of being inside a host it also doesn't matter where in the world the device is physically located).
Drawback is that while inside the host the hacker is exposed to the host's Spider and IC.
In order to get it ...
If you instead snoop the host icon directly you get to intercept the live video feed being transmitted to the host from all slaved cameras at once.
Think of it as mission impossible when they get access to all CCTV cameras for the whole facility at the same time.
(but you still need to mark the specific live feed file icon of a specific camera if you want to continuously edit it in real time to scrub away your team as they pass the line of sight of the camera).
make the Matrix Perception Test within the Host in order to spot any camera or drone
Depending on your reading you might or might not automatically spot icons you are directly connected to.