Seconding esp devices. Especially running open source firmware (I used tasmota, there is also esphome and probably others) super reliable and much lower risk of spyware.

Both! Connecting Iot devices to your LAN is a security risk, since they sometimes carry malware. Many DDOS these days are performed by smart bulbs or the like. May even sniff in your network. Of course you can firewall them, but why bother with wifi at all then? Zigbee is pretty reliable and works even if your router goes down (you probably can't access Home Assistant Web interface anymore, but zigbee light switches etc will still trigger zigbee bulbs, zigbee thermeters will still report their sensor values etc).

I'm a Zigbee user so I use that in the examples but I'm sure the other options are fine as well.

Most wi-fi smart devices use cheap components and will often drop off the network for seemingly no reason. As long as you do some basic planning, Zigbee and Z-Wave are pretty solid. There are some folks here who will say one or both of these technologies are on their way out because Matter & Thread. I’m not sure I agree with them, but even so, HA supports Matter, so… when Thread devices become as ubiquitous as Zigbee & Z-Wave devices, you can replace them as they die.

Most WiFi devices these days are cloud-based, at least on the American market.

If you can find a Zigbee or Z-Wave (or the up-and-coming Thread), those only work locally. The only way to get remote control is to expose HomeAssistant (or a similar hub) to the internet - usually using a VPN from your remote devices into your network.

It’s a bit more upfront work, but no one can track your devices, they’re off grid/much harder to hack remotely, etc.