The communication method doesn’t mean anything security wise. Here’s a simple example.

Device #1 is an ESP32 based WiFi device with your own firmware. It won’t phone its Chinese parent company every hour because you made the firmware yourself. It’s no less secure or more wrong than using your phone hooked to your WiFi.

Device #2 is a ZigBee device. It doesn’t have any connection to the internet. But you need a hub to interact with it and you decide to use Amazon Echo for simplicity. Now your house is fully owned by Bezos.

You need to inspect every device to see if they suit your needs.