If I'm being charitable, I assume most of these IoT devices that could just use local-only networking for basic functionality do it through a central (Internet)

If I'm being charitable, I assume most of these IoT devices that could just use local-only networking for basic functionality do it through a central (Internet) server for 'security'. If the device just opened a simple TCP/HTTP server on your network for phone app access, there would be dozens of breathless articles from the typical low-quality technology sites claiming that your washing machine can easily be monitored by hackers. By hitting a specific LG domain and verifying/pinning certs, the vendor can ostensibly secure that central API and easily make updates if issues are found. It sure seems like it would be much cheaper to have the device simply connect to Wifi and be able to respond to simple TCP packets (TP-LINK smart switches do this) rather than build all this centralized infrastructure that costs money in perpetuity.