Philips was supposed to allow local only, that was a big draw over WiFi-bulbs that are 100% cloud dependent. If hue really is phoning home without permission, I’ll replace their hub with a zigbee dongle on my HA server.
I was always skeptical of Philips Hue because they seemed shy about using local only or even the fact that they're just zigbee bulbs in their marketing. I ended up going with Sengled zigbee bulbs for myself, but I've always heard that Hue bulbs have the best brightness consistency and color. Also been noticing lately that the smart bulb market has been flooded with WiFi and Bluetooth bulbs, and there really isn't a lot of choice left in the zigbee/local only market. Hopefully this change by Philips doesn't lead to them dropping zigbee compatibility in future products, but them making moves like this doesn't give me much faith.
This is my chief worry with Thread. Zigbee is guaranteed to be local only, but if they switch over to Thread, the individual bulbs will be able to call home, even if they expose some of their functionality locally via Matter. With home assistant, one can probably configure their Thread Border Router to not allow internet access, but I have a suspicion a lot of supposedly local thread/matter devices will be designed with the assumption that they have cloud access and won't function fully if firewalled.