An Arduino can run a web server. It's amazingly cheap to run HTTP.
> 2. Security: machines at home should be controlled inside the home or by computer controlled by home users, which could be sitting in the cloud with other OS level of security instead of HTTP or HTTPS. If you are going to expose all of your device status to the internet, do you feel secure? If you do want to control, you need to find some way to make schedule or via the cloud to control them.
My door lock, thermostat, and smoke/CO detectors are already controlled "via the cloud". In for a penny, in for a pound. You're always free to not buy the devices.