The answer to this question is more general than the specific hardware you referenced in your question, and not Android specific in any way, but since this question seems to arise from time to time I will answer it as best I can so that people can see this isn't "magic" in any way.
The reason this is showing your password is that the QR code for WiFi information stores and transmits the WiFi password in plain text, so that anyone who scans the QR code will have your WiFi password. The QR code isn't something special here: although you can't "read" it per se, any device that knows the standard code used for the QR symbol can read it just like words on a piece of paper. This is just how QR codes for WiFi are done and it doesn't matter if it is a TP-Link, Asus, Linksys, or any other device creating them: the password is in plain text. It also does not matter what device is reading the QR code: whether it's Redmi, Samsung, Apple, Google, Huawei, or whatever, it can read the QR code and display the network name and password in plain text, although some apps might "mask" the password for basic privacy (but they do have the information).
The proper way to handle this security in a home environment is not to give your WiFi password out to your friends, only to your family (or set it up yourself for them, although they may still be able to retrieve the password). And for your friends' or guests' use, have a separate SSID with a simple password that is setup to only access the Internet (commonly called Client Isolation), possibly at a throttled rate. I don't know about TP-Link, but many companies like Asus have an app for your cell phone that can very quickly allow you to enable a guest WiFi network for a certain period of time (say 4, 24, 72 hours) then automatically disables it. This example is useful for friends who are over for dinner, the entire day, or weekend perhaps. Some people, myself included, just enable a guest network with a password all the time, but this network has client isolation (users can only access the Internet) and it is throttled to about 1-2% of my ISP speeds (they have 5Mbps down and 500Kbps upload to use) and I change the password 3-4 times a year and put it on the fridge. None of these are perfect answers to security, but they are usually good enough.
Otherwise, if you are giving people access to your network, you might as well just give them the WiFi password... Once they are connected to WiFi it is largely the same as if they plugged into your network with a cable and can access everything, so having physical access to the network and having the WiFi password are essentially the same thing. Besides, it is fairly easy to change the WiFi password later if needed to restrict access. It also isn't a bad idea to change your WiFi password on a regular basis, once every 30-90 days or so, so that if the password is out there, it cannot be accessed later if things change, like your friend for whatever reason is not your friend any longer.