It’s all relative. My cheap Chinese spyware SmartLife devices are free to report the hours I turn my lights on back to China as they please, but they sit on a segmented VLAN with per client isolation.

If they ever EOL’d them, I’ve got more than my money’s worth, and yes, some of them can be flashed, but I’d probably just buy another well established cheap Chinese competitor.

But I agree, the above is not the use case and situation for every IoT device out there, and there are plenty of devices that I would never consider an internet/SaaS dependent version of e.g. medium to large home appliances.