In theory, Home Assistant could also give users the option to ignore certificate checks.

I also haven’t seen specific details on whether Home Assistant’s implementation allows sensors to contact the internet by default or what setting changes this.

It’s just foggier and less user focused by design in my opinion. But as one would expect when Google and other large corporations were the ones to develop it,