I mean, TP-Link could enable all of these basic security features and be lauded in the paper, then you look 5 minutes and find a "system(<web interface input>)"

I mean, TP-Link could enable all of these basic security features and be lauded in the paper, then you look 5 minutes and find a "system(<web interface input>)" level bug in the firmware.