Most smart locks only replace the "back" part of the lock anyway, or augment the physical key slot to leave it as a backup, so, the point still stands that it only introduces new attack vectors. You'd still have the problem of someone being able to copy your "do not duplicate" key not to mention bumping/picking the lock, along with hacking the smart portion of the lock.

In the end, it's your decision, but the OP's comment stands fully: all the same attack vectors still exist, along with a bunch of new ones at the expense of convenience.

> You'd still have the problem of someone being able to copy your "do not duplicate" key

Only if you distribute the “do not duplicate” key, but the whole point is to not do that.

I the the idea was you wouldn’t have to give out the key to renters and could just give them passcode/phone access, so it actually would be removing an attack vector.

Use a keypad controlled, reprogrammable door lock. No internet required, codes easily rotated.

https://www.homedepot.com/b/Hardware-Door-Hardware-Door-Lock...

If you're comfortable using a totally (physical) keyless solution, try a hotel-style mag strip-based access card, or an NFC alternative like a ProxCard.

AFAIK, most code-based locks include a physical lock cylinder as a backup.

Haven't those been found time and time again to be trivially exploitable?

That varies from brand to brand, but generally, yes. Given that it's happened to devices whose manufacturers have a long history of being part of large enterprise security mechanisms, flaws are still being found and actively exploited.

While this isn't an indicator of the quality of newer brands specifically, I believe it's reflective of the state of the industry as a whole -- in that digital physical security as a whole is still immature and shouldn't be trusted to keep bad guys (determined adversaries) at bad.

I feel that "digital physical security" might be limited, but it's still better or the same in most cases as regular old "physical security".

A lock that can be bumped isn't very secure. A lock that can be bumped or it's code discovered via some kind of power-monitoring attack isn't any less secure. But one without a keyway that can be attacked via power-monitoring is more secure in my opinion.

Everything is tradeoffs, and physical security is no different. Don't let perfect be the enemy of good here. If you are in the security industry, you should know that "bad" security that people will use is better than "good" security that people won't.

If a "smart lock" means I forget to lock my door less, I can monitor and record those who go into my house, and I can get alerts if the door is opened via any method, I'd call that a win even if there were pretty significant vulnerabilities that allowed an attacker physically present to get in.

If you're going to run an amateur hotel, then try to do what the hotels do.