More likely that TP-Link is shit at and neglecting product security and this is being taken advantage of. TP-Link firmware for consumer devices is terrible and should be avoided even if that's not entirely deliberately malicious.