[novok]

Z-wave does not require aes128, it can't even handle multiple messages that well and gets congested very, very easily. The more z-wave secure devices you have the more easily your network gets congested, and god help you if every device also reports their power usage. If you want to remove a device from the network to move it to another network, you often have to go through an explicit dejoin process vs just start a new join process with something else.

Still overall a shit experience.

[lancepioch]

Your device can't be certified without it to the best of my knowledge.

[novok]

but it's not required to operate it (you can chose secure or not), and many dont because of the extra overhead and hassle.