They have responded very openly by publishing the vendor specific diagnostic commands.
This whole dog and pony show is very unfortunate, really, since the irresponsible security firm used the term backdoor in a completely inappropriate and misleading way, and the blogosphere and tech press just parroted their claim without bothering to read the disclosure, apparently.
The headlines should have been:
“Security firm Tarlogic makes specious “backdoor” claim at rootCon about popular Bluetooth/Wifi microcontroller deployed in billions of devices.”
A Hildebrand IHD (reads the smart meters and pops the readings onto an MQTT topic). The Octopus Home Mini, and finally, a Tado wireless controller.
The DIY market (at least in the west) came later. I still remember reading the hackaday article about them being discovered back in the day - https://hackaday.com/2014/08/26/new-chip-alert-the-esp8266-w... and back then all the documentation was in Chinese.
I remember a ton of cheap Chinese wifi enabled stuff would come with an esp for a good while, until even cheaper wifi chips hit the market.
As our industry is so fond of forgetting and rediscovering, if your product is easy and accessible to home hackers, it will be used in those hackers' real jobs.
But also they're so goddamn cheap. Espressif somehow scaled production super fast and got the price way below any of the competition.
Is that really all it is? I’ve got multiple IOT devices from major vendors that use esp32. I’ve also seen multiple EV chargers that leverage the platform.
They sold 25% of their shares in a 2019 IPO that valued the company at $716m
Market cap is about $3.5b now