Privacy of the local matter-protocol communication

Heya,

How trustworthy is the local-only aspect of matter-protocol smart-home devices?

I see how the device -bridge-internet approach provides a filter and it’s probably better than whitelabel http devices.

But are these really better for telemetry and spyware, when the firmware is still a black box?

Thanks in advance