I was considering a smart lock for my (armored) front door, but just because there are some locks manufactured here in Italy that can be set to be controlled by external contacts.
Which means I could use and ESP or similar with esphome, now they also support wired, ethernet ones.
That's way more secure than the shitty lock I have now, I've seen videos of people picking that with a decoder device in 30 seconds.

This is exactly the line of thought I think people aren't seeing as the gap. Y'all are too comfortable expecting the internet to be on 24/7. Or the power, for that matter.

If Cloudflare shits the bed again, are your lights stuck on or off? Can you not turn up the heat? We're in a period of history where things will bet worse, not better. The last thing I want is "error: can't connect to internet" being why you can't turn the things you can touch in your house on and off. I get it if you've managed to do the work to have it all locally hosted, but just as-is seems like a bet against one's self.

ZigBee, Z-wave and Thread have virtually 0 attack surface from an IoT perspective, and even then what are they gonna do, do radio hacking to turn off and on my lights? It's not like they can be used in a botnet.
Locks is a bit more risky as an endeavor, but again, it's probably easier to pick the lock than hack it... Actually with the quality of many smart locks, smashing them is easier still.

Smart TVs are way more problematic devices for example, as soon as they stop receiving updates, you have a bunch of high-speed internet connected devices with unresolved exploits just sitting there waiting for the right chance.