Given the ESP8266 brings a WiFi radio and 32bit microcontroller for < $2 on your BOM I think this sort of overkill is warranted. 433mhz provides no mechanism for link-layer security which seems irresponsible in this day and age.
ITEAD do make a 433 MHz version of this stuff, but yes, that's just asking for trouble, given how trivially I can sniff and replay those codes.
You are better off with insecure/obscure radio then insecure wifi (no password or wep), and might exposit the device to the Internet which opens the attack range from your neighbors to the whole world.
At least you do not have to worry about your 433mzh device becoming part of a bot net.
Except in the US as this frequency is used for amateur radio.
Even through that's true, there's still a wealth of devices that ignore that and use it anyway unfortunately. Mostly cheap devices from other countries that I suspect aren't properly fcc certified despite any claims to the contrary. The wireless doorbell at my last place was on 433mhz.