Zigbee and zwave are fully local. They can’t decide to phone home over the protocols without your consent. The hubs can if they are wifi connected but that’s a different issue.

Anything on a network, be it wifi or Ethernet, can (attempt to) phone home without any use intervention, and without a wifi connected hub.

They cannot access the internet because they need a bridge to work. The bridge can be open source software like Zigbee2MQTT.

I'm a little new to this stuff myself, but basically those devices are robust enough to get the job done but also simple enough that they don't do anything else. I have Z-Wave for my shades, a temperature/humidity sensor, a tilt sensor for my garage door, a relay for the opener, and a light switch/scene controller for some physical button shortcuts. Very different things, and I don't need an app from each manufacturer. Each device also creates a mesh network with one another, so these devices can have a pretty low-power, low overhead radio for battery life and still work pretty well even if you're reaching far away from your hub.

I haven't used Zigbee but I understand it works pretty similarly. They seem to have some pretty cheap scene controllers so I was thinking of getting on that bandwagon (my shades were Z-Wave and that's what got me into this rabbit hole so I've been using that to start)

Also, an honorable mention for TP-Link's Kasa series. Hardware is pretty solid and while I do need their app to get a device going, it's made pretty well and integrates nicely to Home Assistant. Now if only they'll put out that fan controller they announced a year ago and haven't given a meaningful update over since!