It surprised me a little. These Hue bulbs are Zigbee only. They don't speak TCP/IP. So using a bulb as the entry point to attack a home LAN requires some chaining of exploits. First to compromise the Zigbee network and gain access to the bridge, then compromise that to work your way into the rest of the network.

I mean, I didn't think it was impossible. But it's not as apparent an attack surface as a wi-fi gadget would seem.

That issue has been raised for nearly a decade now in the security community so definitely not a new question. And there have been stories like this: https://www.bbc.com/news/technology-25780908