It’s just DNS based, and iirc dont require any major effort other than patching the hosts file. Of course it is possible it is not enough, but I have high confidence in the authors after also having watched various talks at I.e DEFCON, that i would be surprised if they missed the firmware doing other nasty things.

Patching DNS is specifically possible to enable/disable on the firmware build tool: I.e https://builder.dontvacuum.me/_dreame_r2416.html and the source for that is here https://github.com/dgiese/dustbuilder-script-public/blob/7afed16999711833a8ac0b3b482e935c3ef77219/modifys8image.sh#L169

Valetudo actively blocks the cloud connections. Also, only firmware versions specifically installed with Valetudo is supported (so no chance an update to the original device firmware happens, and does new things).

I think there’s a very low chance something escapes to the vendor cloud.

None the less, I personally run these on a separate VLAN without internet access.