Four US states have filed suit against consumer router giant TP-Link, alleging the company deceived buyers with exaggerated security claims while concealing dangerous supply-chain and data-sharing links to China.