How exactly does this prevent the same kind of issue for Apple devices? Aren't you just trusting that Apple handles your data better than TP-Link? Not saying they don't but routing through another device doesn't really add security on its own.
I am, yes. Ultimately you’re going to need to trust some hardware, somewhere. No matter what you’re doing you have to trust that your home router doesn’t have an externally accessible SSH port with no password set.
Personally I trust Apple more than I trust TP Link with this stuff.
What if a TP-Link camera supported HomeKit Secure Video? You access the camera through Apple but all of these cameras are still directly connected to the internet, meaning you still need to trust the camera manufacturer.
No, you don't have to trust. I build my own routers precisely because I don't.