Yes there are security concerns with any home automation system, but if you run HA locally and only access it via a VPN like Tailscale you're probably safer than if you used any of the big name cloud first smart home providers. Even if you access it over the Nabu Casa site, because everything is ostensibly Local first your attack surface is always going to be quite minimal.