Yep fully agree on the exterior door locks. That is the one thing that should never be connected to anything even local servers. Also have to be careful with electronic locks in general. Some brands are terribly designed and can be bypassed in a stupidly easy way.

I'm more of a middle-ground person myself. I have Home Assistant fully self-hosted and using a secure cloudflare tunnel for external access. A few other self-hosted containers running other various things. Anything exposed to the internet requires a login. I always try to find stuff that integrates with HA, but I don't go to the full length of finding stuff that doesn't require the brand app to setup. I like the local control stuff if I can get it, because it usually works a lot better, but I won't actively avoid every brand that connects to a cloud somewhere because that's too much effort to avoid for me.