TL;DR<p>The finding by Tarlogic is not suspect, aside from the potential ambiguity in the reporting word choice. Reporters are known for flair, and to drum up FUD outside author or researcher intention.<p>The finding is a undisclosed feature that supports backdoor capabilities without having the glue to call it a full backdoor (semantics imo).<p>Importantly, this is exactly how a clever individual would design a backdoor for plausible deniability and separation of concerns.<p>The fact that it was undisclosed and undocumented means it was secret, and not direct or honest with customers who purchased said devices. Each customer may have a very different threat landscape.<p>By longstanding Cambridge definition, this meets the term definition for a backdoor in general, though is not the working definition among cybersecurity professional contexts.<p>Of note, secrecy coupled with negligence is sufficient for general intent (i.e. malice) in many localities. Which also meets the author's interpretation of the Wikipedia definition, though not the author's conclusion.<p>The conclusions made in the article are nuanced, and not entirely wrong, but I don't care for the doublespeak, it overgeneralizes and misleads sentiment of those who are without a working knowledge of the contexts involved.<p>Is this a backdoor in the cybersecurity context? The author says no, but it really comes down to the legal question, is it negligence if a customer can suffer loss because of an undisclosed undocumented secret in what they bought.<p>This depends, and deviates somewhat in practice and modern law, and I'm not an attorney (IANAL, not legal advice).<p>In western philosophy defects under common law can lead to legal claims and have remedy under a 'rule of law', when it is present.<p>There are modern loopholes that allow manufacturers to not perform the same due dilligence required of physical defects (i.e. disclaim liability for software defects), where it is impossible to remedy, made even moreso by international differences in law (US v. China).<p>Selling devices whose sole purpose is connectivity, where security cannot be managed does violate fundamental cybersecurity principles, and can be used in a classic poisoning the well, supply chain attack.<p>In my opinion, the researchers involved at Tarlogic provided great value in bringing this to the public's attention.