A physical switch is extra BoM / cost, and doesn't make sense in the context of a networked device. Just make it LAN-first / LAN-only. Any Internet-enabled features should happen on the gateway, and be opt-in.
Azure AWS and cloudflare will survive, then everything else will pay them for protection; when all of the internet is captive, they will lobby for regulation to reduce the costs.
It would be better to get the regulation set up before stronger gatekeepers are created
Only way is to secure your IoT devices/routers/cameras/etc.