So, how do I build an IoT device that never sends a single packet outside of my LAN, which my grandma could have set up and run without ever seeing a security warning, and which does not show "Not Secure"?

In general, how can I get all the functionality e.g. a Nest device may provide, while staying purely within of my LAN?

(Disclaimer: For my own IoT projects, of course I use a special domain with DNS delegation and Let's Encrypt certificates, and HSTS preloaded)