TP-link has earned a reputation as a producer of insecure routers. They seem to push things out as soon as the code is functional without any security testing. Yeah, they're absolutely a security risk.

But there's some additional context required here. Pretty much all the other Small Office/Home Office (SOHO) routers do the exact same thing. People want cheap devices and there's no independent security testing reports that consumers can use to tell which ones are actually more secure. So they choose based on price and thus the companies focus on price instead of security.

Second, there's reason to question the threat to national security. These routers aren't secure, but they are also not used in big companies for anything important (if in use at all). Companies are well aware that home offices are not necessarially secure and they keep the data on their server where they have proper protections in place. Attackers getting into home networks is kinda expected and planned for.

Small businesses are at risk, as they generally don't have any cybersecurity. But again, this is not unique to TP-Link nor is a mom & pop shop getting hacked a matter of national security.