> you can pair different vendor's products to the hub, and the hub can translate between them. But while you can pair an IKEA remote to an IKEA bulb without a hub, you can't really do that between different brands.

Yes you can, I did that with Ikea, Philips and Innr brands. No hub, not even Z2M involved. Yes, as you say they do need to agree on a "protocol" and AFAIK they are all following Philips lead on that, but they can totally work in a P2P fashion without any hub. They negotiate their own key, you just need to pair them with a very close distance (less than 5cm approx).