Web server itself could be an attack vector too.

Although not specified to TP-Link, There are many exploits on other brands that can bypass the Authentication. For example this one:

https://medium.com/tenable-techblog/bypassing-authentication...

Even allowing access the web server from internet could be dangerous.