I would say trusting any kind of software with door locks(!) is a terrible idea. Yes, if you use home automation you should self host. No, if you secure your home you should not needlessly expand the attack surface.
I like being able to check the status of my door locks remotely, and lock them if necessary. I like being able to make sure all locks and garage doors are secure automatically before bedtime. I'm not at all worried about someone sitting out in front of my house hacking the Z-Wave lock. By the time they figured it out, the neighbors will have already called the police anyway.
Connecting all my door locks (and garage doors too) to HA has measurably increased the security of my home.
There is no perfect security, only risk profiles. I would argue the risk profile of door lock automation is low enough not to be worthy of concern in most cases.
If your home is targeted specifically, yes. However, if a group hacks a cloud lock provider and then hits several homes using that without having to do something that looks supicious like physically breaking the door then it could be a lot safter and thus profitable for them.
On the other hand, in reality I am not going to be targeted by competent hackers (who would own me at once), but rather a crude gang of misfits roaming around for an easily burglarised home.
The threat isn't a competent hacker targeting you directly.
The threat is a competent hacker targeting the lock's vendor, getting their whole database, then selling address, entry code and occupancy times for $20 per home on the darknet.
Threat: Hacker owning vendor and selling info on darknet Threat likelyhood: 1%
Risk: All valuables being stolen. Risk value: High if you keep a few kilograms of gold in your home. But basically depends on your possessions.
When we were burglared while sleeping a few years back the perp entered through a window. It was the last window not switched to a new one more secure. It took him around 15 seconds to enter. He left with the DSLR, a TV, clothes, a few valuables lying around and my SO's purse. Additionally, because traditionally her car keys were by the door on ground level he could grab them and put everything into her car and leave.
Nowadays our purses and keys never stay downstairs when we go to sleep.
I think the risk profile for traditional break ins is way higher than the risk from a smart lock (not that we have any).
And if they're going to do that, it's quite likely easier to pop a window lock than it is to buy a darknet database of API keys.
What locks are you referring to where locally configured entry codes are stored in a cloud DB? That's not the case for any of the ones I've installed.
This reminds me strongly of an ex-employer of mine, whose response to a security vulnerability was inevitably "our customers won't do that". It's one thing to have a threat model, it is quite another to dismiss low-hanging fruit (and trust me, whatever "smart" lock you have is very low-hanging) as not a big concern.
I.e. automating your door locks may very well increase your actual security rather than reduce it, if it causes your doors to be locked more often than you'd remember otherwise.