My hobby is designing smart home systems and building my own smart devices, as well as being a cyber security expert in my day job, so I’m actually a primary source.
Plus, don’t rely on strangers on the internet to spoon feed you sources. It’s pretty easy to do your own research (which is how I learned what I know. If I’m dubious of a claim, I research it myself, which is why I possess the wealth of knowledge I do.
But you can easily find the security risks posed by Tuya with light googling.
The worst that can happen is they don’t return the disk