It’s real, the gateway topics are documented and anyone can implement them. But then you own the patching, the SD card dying, the buffering logic, credentials on the box. From the security side I’d only sign off on a Pi if someone is named as owner of it.