I grok this to mean that a backdoor exists for customer service ...
If the backdoor existed for customer service reasons, the customer would be told about it rather than HP having to admit it exists only after someone spotted it and went public.
This could mean we can't consider purchasing HP equipment and have to get rid of any we already have - our contracts with some of our clients (banks, a police force or two, and so forth) demand that every one working for our company and any third party that has access to our equipment in any way is fully background checked. If there are accounts on there for which we don't control the credentials then we can not give them assurances that such due diligence clauses are satisfied. While needing network access is a mitigating factor limiting opportunities to abuse this hole, may not satisfy such contract clauses as we need to account for breaks in security elsewhere in our provisions (theft of equipment, unexpectedly clueless or gruntle-less individuals in the DC, ...).
... which can be activated by a customer
TFS doesn't say the user has to activate it, just they they intend to gain permission before using it. This might be by means of it being disabled until the user takes action to allow access, but the wording does not explicitly say that and if it is open aside from proper firewalling and other provisions it might be exploitable by a bad actor with your DC.
Indeed, whatever the case: Please post a not-purposefully-scary summary of the actual problem below, because right now it sounds a whole lot like the not-backdoor that Remote Assistance is under Windows.
The key concern from my PoV is more that it exists but was "hidden", rather than what it actually does. It causes the appropriately paranoid to ask "what else is in there that we do not know about?". While there is an assurance that it does not allow access to data they confirm it allows enough access to be used for DoS purposes and as the feature was not previously documented at all (hidden, to take a more negative spin on "not documented") I would prefer some 3rd party confirmation before taking that statement as any sort of assurance.