yeah, he’s got a bunch of videos on his YouTube channel where he pulls the firmware and analyzes some of them. He does often criticize CISA for insufficiently verifying findings before reporting or reacting, but he does sometimes find stuff on TP-link devices.
That said, I just found a video where he seems to be in agreement with your position as well, and I must have missed that before: https://youtu.be/EPmc4oQon7o