This, I have plenty of smart home stuff all run locally, and every external call is something I can control and disable. Having a smart home isn't inherently the problem; outsourcing all the computation to cloud servers run by unaccountable corporations is the problem

yaml is susceptible to things like the Norway problem: https://www.bram.us/2022/01/11/yaml-the-norway-problem/

There's also a lot of stuff that can go wrong with deserialisation that make it a tricky dependency for security purposes. I like how yaml looks and it's obviously much better than XML, but it had those potential problems