Just fyi the Philips security thing does apply to the hub as well. If you care about local only access ensure your hub is on a vlan now with no internet access so it cannot capture the eventual update that will push a forced cloud connection. Philips has explicitly stated this is coming to all hue devices and that you must sign in with a “hue account”.
If you must buy them ideally buy them used so you do not directly financially support a company that is hostile to its customers