We have a lot of devices and never have any issues. But yeah, if you put a lot of Tuya Zigbee devices with crappy firmware that flood the network. Similarly if you put a lot of crappy WiFi devices on your network, it's a security nightmare (wise people put them on an isolated VLAN and use WiFi client isolation).
Thread has the advantage of consuming very low power so battery powered sensors and remotes can run for years. Wifi is only used because it doesn’t require buying a thread border router.
Luckily this is my setup.
I am not opposed to the possibility of cloud connectivity (as long as it is deactivateable) and even if I weren't I think I still prefer Matter (thread/wifi) over nearly all non-matter devices I've ever used, especially all the problems I had with Zigbee devices will make me stay far away from it. (Even though I am aware that many people had gread experiences with zigbee.)
Before Thread 1.4 the IPv6 addresses used by the Thread network were all ULAs - i.e. the devices were only routable locally and didn't have a global IPv6 address, so if you did happen to want to talk to your Thread devices over the internet, it was possible but the Thread border router had to do NAT for you.
With Thread 1.4 the border router can assign device IPs straight from the global IPv6 block assigned by your ISP, which means you can directly access your Thread device over the internet without the NAT provided by the Thread border router. If you don't want to locally host your smart home automations (you and I do, but the average consumer doesn't) this can be very useful.
IMO this fits perfectly with the philosophy of IPv6 - every device can have a globally routable IP address without needing NAT.
If you don't want your devices reaching out to the Internet (like I don't), the solution is to put all that stuff on its own VLAN with no Internet access (which I do).
In Thread >= 1.4, devices can request globally routable IPv6 addresses. The Thread 1.4 white paper does not hide the intentions:
The Thread 1.4 Border Router acts as the IPv6 router between the Thread network and external networks, including the user's home network and the larger internet. It is by default configured to support external communication [...]
Cloud Connectivity: Direct internet connectivity enables Thread devices to easily connect to cloud services. This facilitates remote monitoring, control, and firmware updates, enhancing the user experience and enabling remote device management capabilities. Device vendors can now directly service and support their deployed fleet of devices, regardless of which application ecosystem each device is integrated with.
https://threadgroup.org/Portals/0/Documents/Thread_1.4_Featu...
This is what you get when you let Google, Amazon, Apple, and Samsung design a smart home standard. They'll use every opportunity extract analytics and increase control. You'll own nothing and be happy.
Zigbee, Z-Wave, and ESPHome over WiFi/Thread are the only major modern local and privacy-preserving smart home standards.