You need some way for the device to communicate with your backend, and private keys work pretty well. For the devices I work on these keys are unique for each device, and transferred over to it during the setup process.

Not necessarily, if the private key is different for every device. What would you have done instead?

seems to be the same in all bulbs :(

Provisioning each device with a unique certificate signed by a vendor CA is what I would call absolute best practice.

It's possible this certificate isn't that and is instead reused across all bulbs. We don't know that. And even if that is the case, there are no details on what this certificate is even used for that would allow us to determine if this is any sort of security problem.