TBH Apple is probably correct to worry about security at this early stage. It may seem ridiculous to you, but if you project the increasing complexity in high end LED bulbs forwards a few years, it is inevitable that they will start containing more powerful embedded CPUs. Even today, embedded CPUs only cost a few cents, and come as part of mesh networking / wifi radio systems.
Today, I can remotely telnet into a lot of cheap home routers and access their command line interface - in the past this remotely accessible command line interface was only offered by thousand dollar workstations.
Conceivably, a malicious person could remotely access a poorly secured wifi-enabled lightbulb and use that as a gateway to access the rest of the system. And when that system is also connected to your door locks / to Google Alexa / your home security camera / baby monitors / your PC then your problems are just starting.
Better to bake in security at an early stage rather than try to bolt it on later. Apple is right to require good security on home gear - and it also helps with getting recommendations from rich early adaptors.