My general rule of thumb is I NEVER buy anything IoT that is WiFi based. Zigbee or Z-Wave based devices will save you a lot of security nightmares (though definitely not all).
(It's also much more power-efficient; you can't really use wifi on battery powered devices unless you charge them frequently)
Low power: it should not require much in the way of network traffic or heartbeats so that you could leave the radio mostly off.
Mesh networking: ideally the devices should be able to repeat commands so that they could be low-power and not have to broadcast across entire houses.
Secure: it should have specific ways to join a network that don't require a keyboard on the device.
IoT application focused: the protocol should make it easy to do things like turn a device on/off, set a value or read a value.
Z-Wave and Zigbee do these things (for the most part), while WiFi is sort of hacked to try to maybe accomplish it. For instance, my Z-wave thermostat has been running off the same lithium AA batteries for about a year now, and the battery level is at 77%. I can't imagine a WiFi device being able to achieve that.
As these devices become more popular, we'll start seeing more Zigbees and Z-wave devices become commodity hardware.
Zigbee has built-in, easy, encryption. You simply set your router to allow unsecured joins temporarily whenever you get a new device, which then learns the key.
When the network is set to allow only secure joins only devices pre-configured with the key can see anything other than encrypted frames.
Of course, wifi has gotten more secure over time to the point that I'd be more concerned about giving the devices internet access than I would about intruders on the network.
In just one highrise project I did in Las Vegas last year we installed something like 65,000 Zigbee devices, and that's not atypical for highrise hotel construction. Zigbee is everywhere in building automation.