For home automation I use Home Assistant, for several years now (~6-7). I had two goals when I began; no cloud and not critical path. Being a software engineer with a degree in electronic engineering it was no issue for me to build my own hardware with ESP32 or ESP8266 and create my own IoT devices.
The no-cloud thing has worked out pretty well, I still don't connect to anything in the cloud, and I block call-home functionality in my firewall such as that of the Philips Hue.
The non-critical path thing has been great too. I can control all of the lights with Hue switches or the physical switches, the sensors for motion can be disabled if we have certain guests that aren't tech-savvy enough (or frankly just used to) deal with motion sensing lights. The automations are all enhancements to rather than driving the core functionality of anything in the home, and so if/when it falls over, things go back to the "normal" level of convenient; you have to turn on lights yourself, or use various remotes for things, the heating becomes manual, etc.
Security is still hard in IoT, good security needs good hardware, and IoT is rarely that, and by good I mean decent memory, hardware accelerated encryption algorithms, hardware secure key storage etc. Coupled with the extremely poor programming practices of a lot of IoT devices, security is all but a joke.