That’s always a possibility especially when every company under the sun is making smart things on a whim for as cheap as possible. I don’t trust any of them as far as I can throw an oven.

I have a few random smart things, but before I connect them to the internet I make sure they have a decent api that I can use, block external access from the router and set up a little interface so that I can VPN into my home and control stuff if I need to. So in order for anything to be compromised my whole network would have to be owned. Which is still possible but I trust that a lot more than letting 20 different apps for each device have access to anything in my home.