My company was one of the first to have a HomeKit thermostat, and the biggest barrier was the hardware requirement.
For Google or Amazon home automation, it goes from device to AWS or GCP, to the vendor cloud portal, back to the home device or bridge to those devices.
In my eyes, that "out and back on a different channel" is the problem.
Home kit devices can be controlled without an internet connection (I've just tested this) though the voice control of them still does the speech recognition in the cloud.
So, the home kit (via HomePod) does device to cloud to device to home automation.
I would contend that this approach is more secure - the control of the home automation devices only comes from the HomeKit hub rather than the internet. How much more secure that is - one can debate.
Moreover, does any Apple server going down mean you can’t use your lights? Like what happened a few weeks ago with Google, someone I know had their entire house behaving like a poltergeist.
As GP mentioned, HomeKit works when your internet is down. It only uses Apple’s servers for out-of-home control.
My setup is:
* HomePod as the HomeKit hub * Hue bridge (no external connection)
I disconnected the network at the modem - the entire house was without an internet connection for the duration.
Neither HomePod Siri nor an iPad Siri was able to control the lights via voice. However the iPad and various Macs were able to control the lights.
The only thing that HomeKit uses the cloud for is the voice recognition of things spoken to Siri.
The default configuration has an integration for HomeKit such that it bridges devices that do not have dedicated support. For example, I can control my Google-only through my iPhone.
Highly recommended, especially the appliance vm image or docker (hassio)