If worried about security concerns, just provide a common port interface (RJ-45/RJ-11) on the unit with a simple, well-documented, serial-based protocol on RS48

If worried about security concerns, just provide a common port interface (RJ-45/RJ-11) on the unit with a simple, well-documented, serial-based protocol on RS485/RS232. You can sell an add-on device to bridge that to Ethernet/simple API, and easily replace/recall that inexpensive module if there are issues. The hackers will do what they want to anyway, and they'll implement cool interfaces/HA plugins/controllers on RPis or ESP32s for free. Someone will get enterprising and package a pre-built/programmed ESP32 unit that makes it plug-and-play for nerdy, but less capable users, and your company can avoid any liability from users using an 'unsupported' add-on.