I’d be far more worried about a personal computer getting compromised before believing a Philips (or other mainstream hub) was popped.

Is it possible? Absolutely. We don’t know how secure these place’s software supply chain is.

I’m confident keeping it at “it’s just a lightbulb”, at least Zigbee bulbs, because the attack vector for this would take so much effort for it to be effective.

Sure, if you’re in a high-risk category, like if you live in an authoritarian state and you’re the popular candidate espousing democracy, I’d completely agree and say trash all of your wireless devices.