Like others have said - don’t buy Cloud based products. Don’t buy from huge marketing companies intended on World Domination.

That being said, there are lots of good options.

HomeAssistant, Homeseer, and certainly our (Allonis) myServer controller.

Speaking specifically about myServer (I think this applies to all three), there is no requirement for Internet connectivity. The only things you need Internet for is: Software updates from our cloud server, optional TVGuide data, optional Weather data updates. Remote assistance from Allonis. We have done high security installation for the government, a prison, and schools and a very popular Silicon Valley company. All require NO Internet connection for security. Some required the system to be on it’s own standalone network (not even from a managed switch).

Even our in development voice control system does not require any Internet access. Optionally you can decide to forward your “words” (not your conversations) to cloud based services that you are all very familiar with. But the core “remote control” aspects are handled by myServer in house.

We haven’t done Matter development yet (not ready for prime time) but I don’t believe there is any requirements for Internet if it’s executed with that requirement from the company that integrates it (Allonis). Feel free to raise and cite exceptions that are known.

Z-Wave and Zigbee and Lutron and DMX and hundreds of other protocols don’t require any connection to the Internet.

Make sure you have a well architected and engineered network starting with your firewall. Make sure you have modded the default password!!! That’s the number 1 gotcha.

Don’t give anyone access to your non Guest network. Ensure your Guest network has no connection to your devices or computers on your network.

Create a Control Network that is it’s own subnet independent of the rest of your casual use PCs. Ensure you use good password control of your Wifi network.

Anyway, the above items brings you into a pretty secure environment.