Many moons ago, Zigbee/Zwave stuff got spooked out of my head because the comms protocol was unencrypted, and anyone could walk by and start doing things to my devices. Has this improved at all? I don't like having every single smart device on my network talking WiFi either, but I can at least sandbox that stuff away to a separate network, and use things like HomeAssistant if I feel the need to go full paranoid android and limit external connectivity.

Newer versions of Z-Wave are encrypted for "secure" devices, which afaict is most of them. My door locks are all set up in secure mode, and in fact if they're not linked in secure mode they're read-only.

At least for Zigbee it was never the case, the encryption is there since the first version.

Which Z-wave hubs can I trust to still be working in the future? Is there some z-wave card or other hardware plugin I can DIY add one of my home machines, along with software to control and monitor. In 2016 my Staples Connect z-wave hub became a brick when Staples shut down that department. Now my Samsung 2019 z-wave hub is also abandoned by Samsung.

Hubitat will still be working. It runs 100% locally, and you don't need the cloud for anything. There is an app for remote access if you want.

And you can do remote access yourself if you are skilled with tunneling through your router.

Thanks. Hubitat looks good. I see it has MQTT [0] interface which makes it compatible with almost anything. OpenHAB for my case, and Home Assistant too. I think NodeRed support was available even earlier, which is also a good option.

[0] https://docs.hubitat.com/index.php?title=MQTT_Interface

You can also write and install drivers for anything you like. And you can also write apps for it.

And there is a huge community who does exactly that, for anything not provided.

Basically even if the company when under, you could keep using it by replacing everything built in with user installed stuff.