These risks apply to every TP-Link product. They are legal obligations and corporate practices that individual products cannot override. A subsidiary cannot opt out of an FTC consent decree. A company cannot selectively ignore its home country's intelligence law for one product. These risks set a grade floor of B — no TP-Link product can score better than this, regardless of its own privacy settings.