I prohibit IoT devices from connecting to the Internet at all, and only use devices that can be controlled by the local network [0]. Thus firmware updates don't matter (as long as the manufacturer hasn't included any logic bombs), as the trust model is that devices are just an extension of the network segment.

The least-involved way to set this up would be to set up an old wifi router to create a second network, don't connect this router to your existing network or uplink, and then set up your home automation server with two ethernet ports.

[0] eg TP-Link Kasa, although I heard this may have changed for recent ones? Either way, with this setup you'll be immediately aware of whether local control functionality works, so you're well within the return window. FWIW I stay away from Amazon's GENSYM brands, even though they'd be easy to flash with Tasmota etc, because I don't trust them to get line voltage design considerations right and I don't feel like QAing every single device.