Being documented is not enough. Implementing a commercial device requires including an Authentication component (before it used to be an actual chip, now it seems it can be done in software), and that can be used to prevent devices from speaking to alternative control apps.

From what I can tell, Homebridge implements Homekit as a device, receiving commands. But can anyone build an app or device to send commands, outside of iOS?

The fact that I can't find an Homekit control app for Android strongly indicates this is not possible.