This is a good start, but since they are on the same wifi channel and encryption, a lightbulb could go promiscuous and listen to all the traffic on other subnet

This is a good start, but since they are on the same wifi channel and encryption, a lightbulb could go promiscuous and listen to all the traffic on other subnets, and interrogate them in turn. I don't know if we need secure lightbulbs that only communicate with strong encryption.. As always, there is no use in just depending on "gateway" defense of networks, and you should always assume that any network is open to the internet in one way or another.