It would be a lot more difficult to hide a backdoor on a bare ESP device, than a proprietary Tuya one, just putting that out there. Regardless, I still block internet access from my ESPHome devices, because I don’t want to feel like I need to constantly be on top of updates, that can cause things to break at times. I do them every couple months when I have the time to sit down and make sure everything’s still working, or roll it back where it’s not.