I personally just flash everything possible with open-source software. All my light switches and Wi-Fi lightbulbs run Tasmota, which I password protect and semi- regularly update. The one odball is my Gree AC unit, which is on a separate WiFi network and subnet (I just run hostapd on my RPi since it's close-by). But it's more to protect it from the outside, not the other way, because it's controlled with JSON sent over UDP, and if you send a malformed packet the microcontroller inside crashes. When this happens and the compressor is engaged it will freeze up, possibly destroying itself and start flooding the floor, because the condensation pump won't turn on.

In addition to all of the "use Z-Wave/Zigbee as much as possible" comments (which I personally do), for stuff where there's no choice like Roombas, I have a separate SSID on a VLAN that can only talk to the internet, my DNS server running Adguard, and HA (which is on the main network). I also have stateful rules that allow connections to be initiated from the main network to the IOT network, but not vice versa. I also try to find things with ESP* controllers, as mentioned.

I've really been trying to move away from cloud based stuff not only because of data privacy, but concerns about services going away and (most importantly) latency.

My old wifi smart plugs had 2+ seconds of latency from when I'd hit the button in HA to actually turning on. Zigbee/Z-wave stuff is (from my meatsack perspective) instant. I have a zigbee door sensor on the door to get into my garage, and a zigbee smart plug connected to the overhead florescent lights. By the time the door opens enough for me to actually see inside the garage, the lights are on. Sometimes I think they never turned off. It's fantastic.

I prohibit IoT devices from connecting to the Internet at all, and only use devices that can be controlled by the local network [0]. Thus firmware updates don't matter (as long as the manufacturer hasn't included any logic bombs), as the trust model is that devices are just an extension of the network segment.

The least-involved way to set this up would be to set up an old wifi router to create a second network, don't connect this router to your existing network or uplink, and then set up your home automation server with two ethernet ports.

[0] eg TP-Link Kasa, although I heard this may have changed for recent ones? Either way, with this setup you'll be immediately aware of whether local control functionality works, so you're well within the return window. FWIW I stay away from Amazon's GENSYM brands, even though they'd be easy to flash with Tasmota etc, because I don't trust them to get line voltage design considerations right and I don't feel like QAing every single device.

if you flash openwrt/ddwrt to your router, you can create an isolated subnet with its own DHCP server and enter your own firewall rules (iptables) blocking all traffic from your local subnet to your IOT subnet. You can then bind that to a wifi ssid (the guest one). Its kind of a PITA to setup, but it works great once you get it. Netgear Nighthawk routers have worked great for me in the past.

Don't forget to set up a reverse proxy with ssl and automatic cert renewsl, even in your home network. Wifi can be hacked with trivial ease. Caddy or nginx/certbot will do you well there. If you also run a pi-hole you can have the pi on your local network pass ssl checks by overriding some DNS entries.

I just don't use Google or Alexa (devices from those ecosystems punch holes through my home gateway for a bunch of server-side glue that is extremely ill-advised, and a bigger risk than LAN security IMHO), moved most things (sensors, typically) to ZigBee, and reflashed everything I could with Tasmota.

It's extremely inconvenient to have IoT devices segregated from, say, TVs and media devices, especially if you rely on AirPlay or Chromecast to get audio around the place, so I just secure my Macs (and PCs) properly as if we were still traveling and visiting clients.

I keep tabs on Apple security bulletins (HomeKit has relatively few issues, and works mostly inside the LAN except if you're outside the house - it then switches to a variation of the old iCloud "back to my X" tunneling).

One, I avoid WiFi products entirely if there is a good alternative. Zigbee and ZWave are two good ecosystems, you get a USB radio, plug it Home Assistant machine and you're up and running.

A second option is finding devices that can be flashed with Tasmota or ESPHome. This could also mean putting together your own devices with an ESP8266, ESPHome is basically plug and play for simple things like temperature sensors. You assemble the device, configure which pins to use via YAML, and then flash it to the ESP.

You don't even need to download a local build toolchain, the ESPHome add-on to Home Assistant can flash devices plugged into your computer just from the web interface, and then do OTA firmware updates.

Not OP, but I make extensive use of VLANs to isolate off security cameras, IoT devices, etc. etc. into their own mutually isolated network environments.

I also don't use Wifi for any of these devices anymore. It's usually a bad experience. Either use ethernet or a dedicated IoT-oriented wireless protocol. Z-wave seems OK but not very flexible, Zigbee is a pain in the rear (but the only option for many device classes), and I'm hopeful that Thread will actually be good.

For me I mainly use Zigbee and Zwave Devices not WiFi Devices.

I am sadden that wifi seems to be taking over and ZigBee and Zwave are starting to lose favor.

I use mikrotik router with separate vlans. Also use open firmware (usually tasmota) on 95% of devices.