Every IoT device already uses esp chips, that's the only reason they can afford to make them. Them being low security doesn't matter, it's not like smart homes are secure now. Security is not important to IoT devices.
If someone wants to get a hot air station and a bunch of $1 chips and reprogram their own devices, it would cost them less than a hundred dollars, 150 tops.
Anyone can learn any skill. If you can draw anything recognizable, you can do electronics.
From AliExpress, it'd probably be $2-$3 including shipping.
They don't ask questions when ordering large volumes of microcontrollers either.
They are popular only because they are so cheap. Also, so far as chip shortage, China kept pumping them out.
Ikea, for example, ships tons of "smart lightbulbs" with silabs/EFR32.
I don't think security is a real problem for me. Smart devices on their own intranet takes away a lot of problems.