Phillips Hue doesn't have this problem because it uses Z Wave and not WiFi.

You do need the hub, but the attack surface is reduced, the basic bulbs are cheaper, etc. There probably is key material in the bulb, but who wants to impersonate a light that can only exchange simple binary (no strings to parse) messages with the bridge?