You throw out an LED smart bulb maybe once every few years? Probably one of the single worst ways to target an individual.
If I find bank statements or other correspondence containing personal information, all of that gets added to the "dossier." If I find a hard drive, I'd plug it in and poke around. If I found a birthday card, I'd check the date it was mailed and have a good idea of when you were born. If I found a smart bulb... well, now this is just one more small extension of your personal attack surface.
Take this a bit further - what happens when the healthcare startup with 50 or so employees installs smart bulbs? Let's say the bulbs last on average five years, and they have 50 bulbs in their offices. That's ten bulbs failing per annum, giving a ~80% chance of finding a smart bulb in their trash in a given month. An attacker gets one of those, and is able to connect to their internal network over WiFi. From there they can poke around on internal machines, and would probably even have access to a whitelisted origin IP for SSHing into production machines.
I think they have bigger issues than whether the bulbs themselves are secure (even if they are the manufacturer).
It's still one more vector that doesn't need to exist, because there is no reason what-so-ever that you need a Wi-Fi chip inside your light blub!
… at which point they need to break SSH/TLS after getting off the IoT sandbox network. I’d worry more about phishing and malware, and focus on deploying things like MFA first.
If they aren’t doing any of those things (or, in your example, not using a paper shredder) PCI & HIPAA are going to be a lot more of an existential threat than someone dumpster diving.