They do accept traditional keys but the whole point of the lock is to delegate restricted access to people at certain times and with logs/notifications. So a physical key is like an admin override, not to be used in normal circumstances. As such, only me and my partner have them, and we generally never use them. In a wonderful example of Murphy's Law we were both out of town this weekend so all the people that were supposed to be coming to the venue to set up for a show were locked out with no recourse, it was a huge mess. Long story short, the use case of these locks renders the traditional key fallback less than ideal.
Having to pay to send a locksmith to every lock they bricked.
I wonder if a certification body (like UL) could work though. Probably is it is hard to boil "works good" down to a set of clear requirements.
I expect this to continue getting worse. At some point, hopefully, things will change and begin to improve. I think we'll see many more -- and worse -- incidents like this before that happens, though.
What will it take to get IoT device manufacturers to adopt development practices that prevent this kind of thing happening? It's bad enough that most software is bug-ridden and poorly tested, but it's inexcusable for IoT software if they ever expect IoT devices to replace traditional alternatives.