You are still at the whim of the company, who can turn off that data spigot any time it becomes expedient for them.
There's no way to get the data off of the device and use it yourself, without the same data going to their servers.
You pay hundreds of dollars for a device that doesn't let you use it, and rely on the kindness of the company to know your own heartrate.
I have spent my entire career messing around with APIs and platforms and I have no interest in doing this DIY. oAuth into Oura ring's servers, which is totally available to you, is just fine.
If privacy is this much of a concern, why wear a trackable wearable in the first place?
I think people WOULD like to keep their health data local, if given the option.
But companies do things in their own self-interest, including carefully crafted product descriptions, privacy policies, apis, protocols and apps.
I will mention Garmin watches don't require activation or to be "connected" to work.
In any case garmin watches are not all $800.
In comparison, most other devices require activation to work. Have you tried to use an apple watch or a fitbit?
I have a garmin watch, have never used bluetooth, wifi, garmin connect, etc. It keeps track of my health and activities, motivates and makes recommendations. It's really useful to track sleep and fitness level.
The only local thing it does not do is EKG, they lock that until you go online and give your location as in the US.
The amount of work Oura would need to do would be trivial: they'd need to provide a basic description of the format of the packets the ring sends over Bluetooth (or just release protocol headers/internal client libraries). They'd also need to not put in work to deliberately prevent other apps from connecting (which some manufacturers do; not sure about Oura).
I think the concern is privacy, not the user's access to the data.