This might just be a reflection of working with a limited toolset, or of it being more politically palatable to suggest that the PRC is up to something than to suggest that there's something glorious private sector is failing to do; but focusing on one bottom-feeding vendor seems like a really stupid choice if you actually care about router security.
At the level of consumer-tier routers there aren't actually just tons of SoC vendors (Broadcomm, Mediatek and Qualcomm seem to be the big ones that do fully integrated; a few more options if you are doing something wired only or using external wifi support; but mostly other ARM SoC slingers, I think Marvell comes up here, without the complication of worrying about GPUs, until you get up to Atom territory); and a lot of the vulnerabilities are in someone's lousy web GUI, an antique userspace component, or some dodgy TR-069 implementation. There are occasionally driver bugs that are security risks(most commonly to wifi devices, exploitable within RF range, less commonly on wired interfaces in a way that would be exploitable from the internet) but those are generally less common and higher skill than some shovelware web UI not validating an input.
I'm not sure you could make a TP-link really suitable for DoD work just by reflashing it, if you are really that valuable or prominent you can't rule out some sort of clever tricks implemented in a supposedly commodity eMMC part that's actually much higher capacity and rather smarter than advertised; or NIC firmware that listens for certain magic packets or something; but the bulk of routers-are-shit problems in lower performance/price sensitive areas could be addressed by treating it as unacceptable that you have to get your fairly basic embedded ARM linux package from the same vendor who designed the logo on the plastic box it came in.
Specifically for Fed and other high-assurance purposes they should probably just stump up and have some more heavily scrutinized and better trusted vendor slap SoCs from one of the vendors with enough domestic presence to be leaned on together: it'd be more expensive than the offshore low bidder; but probably cheaper(as well as helping to develop and maintain high-trust capacity) than taking the offshore low bidder's hardware and inspecting it to your satisfaction; but in general just demanding that routers be documented well enough to allow 3rd party OS builds from someone who is actually competent at that would go a long way to solve the problem. We've seen(with openWRT and others); that what's basically a hobbyist thing can outperform the average vendor shovelware; if you want a fancy enterprise contract there'd presumably be nothing preventing Cisco and Palo Alto and Fortinet and the like from either offering warrantied images for compatibility-baseline hardware targets or compatibility-baseline compatible hardware targets that meet the quality specs they are willing to warranty; and the feds can always pay BAE or General Dynamics Mission Systems to cook up an embedded linux image that meets all the NSA's recommendations for SELinux-ing correctly.
As long as you pretend that it's some sort of rule of the universe that you get your OS from your hardware OEM(or, more likely, a reskinned version of the chipset BSP that their ODM mutilated into shape for them); you are not going to solve the problem of software quality being fucking dire; while if you abstract the software even just a little bit you open the possibility of having
much higher standards; because while good software requires a considerable number of hours from talented people to write and test, stamping out copies costs nothing thereafter.
What is frustrating is that, for want of some relatively lightweight standardization(lots of weird little boot and flash layout quirks between vendors even on the same SoC); that decoupling is only for nerds, on select models they can work with, or hyperscalers who buy in sufficient quantities that they can just tell OEMs how it is going to be(eg. Microsoft getting sufficiently fed up with assorted L3 switch management OSes that they just
decided that you'd need to run linux to qualify.)
I'm not proposing some nonsense of the "everyone in the homeland must run JucheWRT for security!" flavor; just that it's lunacy to expect the software to get better when it's treated as an intrinsic part of the bundle with the hardware and mostly sold on hardware price to people wholly unequipped to evaluate its quality(at least until you get to the 'business/Enteprise' vendors; whose software quality ought not necessarily to be trusted, just look at basically every SSL VPN gateway provider over the last 18 months or so; but who at least acknowledge software as a major point of differentiation on which their customers are judging them).