ive used smart light bulbs in a botnet before

Yeah that's why I never mentioned WiFi ones. Which can still be secured by not letting them access the rest of the network or the internet. That's what we do in industrial automation, security standards for PLC software tend to suck, but that's irrelevant if it can't be reached.

and if you do a teardown on one of those locks you can probably get the firmware and uart to get the unlock function which you could use theoretically to unlock every single one

I don't see how that's relevant for a lock that's inside an armoured door, it's only accessible by disassembling the door, at which point unlocking it is moot.