Yeah that's what a lot of the responses in this thread don't get or dismiss. These things could be run in a much more privacy protecting way but that comes with all sorts of configuration and setup headaches that most people don't want to deal with. And being able to access the devices from anywhere is a feature most people want even if it's only useful occasionally and a central API running all interactions means if it works while you're home it will work anywhere rather than it working while you're home then not working because something something DynDNS/NAT.