IoT doesn't have to share any data with third parties... it could be shared with you on the local network or your own server... but many devices make it hard... so you have to be careful.
That's correct, but with what we know now it can be pretty much assumed that any security there is will be actively subverted by agencies, companies or both.