I have some IoT devices I made for myself. The all connect to the central server (the one I run myself of course).

It is much, much easier to do things when central server is around. This is especially true for embedded devices which have limited resources and cannot be updated easily and safely. Close all the incoming ports and the chances of your device joining the botnet fall dramatically. Keep that port open and you'll see yourself mentioned all over the net in the context of "horrible security, don't buy".

The only hope is multi-vendor systems which connect to central hub - zigbee, matter, etc.. - but sadly they not very popular, as wifi is everywhere, access is cheap (the chip can found for under $1 today), and hub-based are harder to get started with.