Please correct if inaccurate, but I don’t see in that article where the folks at Espressif refer to it as a backdoor, only the security company. This seems to me as though it is no more vulnerable than any other device which can be compromised by physical access, which is most of devices. The vulnerability really looks to be more in the ability to pivot to other devices remotely after one has been compromised physically, which isn’t ideal, but still doesn’t seem to me to be any less secure than most other devices.