That’s always a possibility especially when every company under the sun is making smart things on a whim for as cheap as possible. I don’t trust any of them as far as I can throw an oven.
I have a few random smart things, but before I connect them to the internet I make sure they have a decent api that I can use, block external access from the router and set up a little interface so that I can VPN into my home and control stuff if I need to. So in order for anything to be compromised my whole network would have to be owned. Which is still possible but I trust that a lot more than letting 20 different apps for each device have access to anything in my home.
The chicken looks pretty cool too, like he’ll steal your wallet and your girl in between puffs before you even finish coughing.