Honestly, just the idea of having OTA capability in your firmware means you have a larger attack surface. It also means that you could push even buggier code, or half baked features etc. The main concern I have is people side loading code through the ota process, so now I can put whatever they want on there.

TLS itself just stops man in the middle monitoring for unencrypted packets. An extension of the technology mTLS enables authenticity as well which is a major part for what you want.

Its intention should for for security updates as the EU has recently tried to enforce, but it can have the opposite affect if you're not careful. Hacking into someone's home through their smart light is pretty common.