I have been doing the same thing. If the passkey tries to lock itself to a particular device, I’m not using it. I don’t feel like having Google, Microsoft or any other software company control my logins. If it can be stored in my KeepassXC vault, I will use it.

This is called demand destruction.

I suspect these controllers were mostly being used for telemetry (getting notified if they lose power), not remote control. But they were still vulnerable to zero-days if not updated. Kind of the same story as all the other IoT stuff that has turned out to be vulnerable.