That’s always a possibility especially when every company under the sun is making smart things on a whim for as cheap as possible. I don’t trust any of them as far as I can throw an oven.
I have a few random smart things, but before I connect them to the internet I make sure they have a decent api that I can use, block external access from the router and set up a little interface so that I can VPN into my home and control stuff if I need to. So in order for anything to be compromised my whole network would have to be owned. Which is still possible but I trust that a lot more than letting 20 different apps for each device have access to anything in my home.
A few years ago I went to visit my mom around Christmas, I picked her up and we were heading over to my grandmas. On the way, while my 1 year old is screaming in the back seat, she asked if she could run into a store on the way.
When we got to my grandmas she gave me the bag that she had just bought, store logo on it and everything, no hiding a thing, that contained 1 roll of camouflage themed duct tape, and a pack of trash bags.
I had told her earlier in the year that I was using trash bags and duct tape to block the windows in my garage while I was doing some renovations in there, and so she got me trash bags and duct tape, almost a year later…
I still appreciate that she got me anything at all and there was at least a thought behind it even if I don’t understand that thought.