Yes, it is a security standard issue, but it's enforced with hardware. So, while this is there for a reason (possibly even setting a standard for these IoT devices), it's not simply a lack of developers building secure software. It's with the hardware not being spec'd to meet these "arbitrary" security standards. I say arbitrary because clearly no one else in the game is using it. So, I think the OP is correct here, Apple has made a product that simply doesn't work with other products due to their own decisions.

Edit: Typos

Insteon is still an insecure and unencrypted protocol, just the new homekit hub is 'more secure' now, controlling insecure items.

You can also install a general homekit proxy with a general nodejs server called homebridge. That homekit proxy can control anything with any kind of security.

So at this point it's just another proprietary standard unfortunately :( Might as well call it another MFi program.

The same standards that let a stranger stand in front of your door and say "hey Siri, open the front door" and walk right in?