The fact that they use ESP-NOW means they can be controlled (theoretically) by any ESP* that has ESP-NOW support. So far, folks have only managed to go the other way—to intercept remote key presses [0]—but I imagine it won’t be long before they suss out control of the bulbs.
The _real_ light switch is permanently on, and the _hue_ light switch sends a beacon to the hub to turn the configured lights on/off (the light bulb socket is always-on)
The default is "Warm white, full brightness", probably mostly to avoid confused people sending back bulbs because they flipped the switch ON and the bulb remained dark. Since traditionally that meant a failed bulb.
I'm using that as a backup solution in my house. All lights are zigbee, permanently powered, normally most are controlled automatically by presence sensors. But I have a couple of Zigbee remotes in a box that are bound directly to the lights to use in case my home automation system is down.