I have one of these and this is why I blocked the wifi bridge from any outgoing network access. The mystery server then just uses the MAC address of the bridge as the "authentication" of where you get to control the lights via the app.

Having a separate wifi network (and separate VLAN for wired) IoT devices sounds like a good idea, and is something that I'll be doing this weekend...

(Also will port-scan the MiLight bridge to see if it's got any other interesting services on it)