You are correct. Some devices expose local API's, most have walled garden cloud API's

Before buying a device, it is a good idea to check if there are open source adapters for it for Home Assistant, those usually show if it can be controlled easily and preferably without cloud.