The solution is to allow local interfaces (matter, HTTP, etc) but most company cybersecurity teams just freak out at this.
Oh, and the reason we don't have a full time team managing HA is like I said.. addressable market versus FAANG/Samsung.
It takes a full time person (persons) to manage Alexa, Google, Samsung, etc.
I've long advocated a local HTTP interface for our products, but usually a losing battle.