I've been considering home assistant, and yeah this gives me pause.

IMHO it's just not the kind of behavior that is expected by the people that use the software.

The fact that it didn't occur to anyone that this isn't a good idea makes me question other design decisions. When local-only isn't local-only, that's a problem.

Just to add to your point, I’ve deliberately avoided home-assistant since this kerfuffle where frenck was quite rude to the NixOS maintainers. https://news.ycombinator.com/item?id=27505277