That was a bit unclear by me. Zigbee relies solely on noone being able to MITM the pairing process, where the security lies in the short window of opportunity

That was a bit unclear by me. Zigbee relies solely on noone being able to MITM the pairing process, where the security lies in the short window of opportunity and short range. But Matter (and thus the Thread devices we talk about here) has an out of band mechanism for sending keys, since it requires QR + BLE. I guess your point is that you typically can't form a Thread mesh between different border routers of different vendors. Which is unfortunate, but solvable. Don't buy/use border routers from such vendors. Because that problem is not the same as not being able to use a device from vendor X on a non-X border router.