It surprised me a little. These Hue bulbs are Zigbee only. They don't speak TCP/IP. So using a bulb as the entry point to attack a home LAN requires some chaining of exploits. First to compromise the Zigbee network and gain access to the bridge, then compromise that to work your way into the rest of the network.

I mean, I didn't think it was impossible. But it's not as apparent an attack surface as a wi-fi gadget would seem.