Selfhosted

ZigBee devices use less power, which means if they're battery powered, it can last longer than wifi devices. It has faster handshake too. it can wakes up from sleep and transmit data in less than a second, while a WiFi devices may need several seconds to connect to your AP if it has been sleeping for some time. The difference in latency is really noticable for stuff like door sensor or movement sensor where the device may be sleeping for extended amount of time. But if you build your own device using esphome, I guess there is no option but to use wifi.

As for security, if they're both offline, is it really matter?

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

4 acronyms in this thread; the most compressed thread commented on today has 5 acronyms.

[Thread #269 for this sub, first seen 9th Nov 2023, 10:10] [FAQ] [Full list] [Contact] [Source code]

“Security” by itself is a meaningless concept. You need to formulate a threat model before you can say anything.

If your threat model is actors on the internet getting into your network using something related to the devices, then WiFi is many times worse. The devices are full network devices, and given for example a rogue firmware update, they can spawn a reverse shell let the actor into your network. This can and should of course be mitigated using the usual network engineering techniques. Zigbee is inherently different. Your light bulbs have no ip address, can’t route IP into your network on their own.

Another threat model is local information leak, someone in your area is listening to your radio emissions to determine if you’re home etc. This is about the same for zigbee and WiFi. They are both encrypted, but the real information is in whether there is communication, not the payload.

In terms of longevity, I would be wary of adding more 2.4 devices on your WiFi network. I can’t wait forcing the whole band.

The communication method doesn't mean anything security wise. Here's a simple example.

Device #1 is an ESP32 based WiFi device with your own firmware. It won't phone its Chinese parent company every hour because you made the firmware yourself. It's no less secure or more wrong than using your phone hooked to your WiFi.

Device #2 is a ZigBee device. It doesn't have any connection to the internet. But you need a hub to interact with it and you decide to use Amazon Echo for simplicity. Now your house is fully owned by Bezos.

You need to inspect every device to see if they suit your needs.