"But if you're not home, your phone sends the command to a server in China,..."
Do any "smart" devices not try to connect to remote servers, automatically, without asking the user for permission?
Do users care that "smartphones" they carry or other devices they put in their home automatically connect to remote servers so various companies can collect data, ..., turn sockets on/off, etc.?
If we do not like this practice and we want to see change for the better, then maybe we should put our comments in Amazon reviews instead on HN, security blogs, etc.