I think commercial routers have a different standard to be held up to than consumer phones and iot devices.

The workaround is really lame and and blocks all traffic to the data leak domains.

I don’t want to send crash data. I also don’t trust a non-open source, non-documented, non-auditable submission of data from my network to theirs. They claim it’s only crash data, but I don’t know. They can also change it at any time as they’ve lost my trust by adding data leaks to a firmware update I accepted without knowing it.

You can just block any connection from the access points to the internet. They can connect to the controller and that's all the access they get. Access points have no need to connect to or be accessible from the outside world.

Ok. I get that it is best practice to give devices the least amount of access they need. But why does being able to block traffic make it okay that Ubiquity enables telemetry like this, without informed consent?