When setting up a kasa smart device, say a wifi smart plug, it asks for the wifi credentials and then it connects to the network.
Since these devices can be controlled remotely via the kasa app, one must assume central tp link servers in the cloud are part of the command and control so a user can operate these devices remotely.
How secure is this setup? With the device on the wifi network and connected to the to the tp link cloud, there must be some risk of a rogue tp link employee sniffing around the network looking for hosts to compromise. That is if we believe tp link doesn't do that as matter of course to at least scan for connected devices on the wifi network.
Will it be correct to assume that by using these devices, we entrust that tp link can do evil but doesn't do it because that would be bad for business? Additionally do we entrust that their systems are secure enough to defend against compromise from outside sources trying to penetrate people's networks?