Never really thought about that. Hmm. I mean, it's GE, a somewhat reputable company, but apparently they were just bought out by a company in China. But it goes through my network, communicates with a cloud service, who communicates with the app on my phone. It would seem possible that whoever runs that cloud service has the ability to do whatever they want in my network through my fridge.

I run a raspberry pi for some automation in my house and use tailscale as a VPN so I can access it as a server when I'm not home. As long as I can trust tailscale, it is encrypted straight from the raspberry pi to my phone. There is no middle man. But having that cloud service for the fridge app is something I need to research.