discovered what Li calls backdoor accounts on another maker’s drive, as well as hardcoded keys in other supposedly secure USB storage products.

What i always say; hardware-based encryption is not secure. It's always in the triangle between speed, security and cost, the vendors go for speed and cost.

And then there's stuff like this:

but the drive sent the correct password back over USB in plain text for the software to compare, making it easy to capture

Cookie-cutting on the developer side.