TP-Link devices have been shown to ship with backdoors baked directly into the firmware.

The TL-WDR4300 and TL-WR743ND have a special unauthenticated URL that causes the device to connect back to your IP, download a file, and execute it as root.

The TL-WA701ND and similar models create a hidden SSID that acts as an unauthenticated bridge into your network.

If you can even manage to report security issues to them, they will only patch models you specifically tell them are vulnerable. So as a researcher you have to buy one of every model to actually get things fixed.