Some can be controlled through a local API, but often you still need a gateway to facilitate access (it can reach out to the cloud, but it can be disabled and used local only).
Some that were in very good standing (Hoymiles) recently had security flaws where the manufacturer refuses to acknowledge or fix them, leading to essentially anyone to control them at any time with a few dollars worth of equipment (source in German). They basically broadcast their own encryption key.
Unfortunately the nature of getting a distributed system makes them much more vulnerable to issues like that as some form of communication is needed for everyday operation. This is much simpler with a central system.
Some can be controlled through a local API, but often you still need a gateway to facilitate access (it can reach out to the cloud, but it can be disabled and used local only).
Some that were in very good standing (Hoymiles) recently had security flaws where the manufacturer refuses to acknowledge or fix them, leading to essentially anyone to control them at any time with a few dollars worth of equipment (source in German). They basically broadcast their own encryption key.
Unfortunately the nature of getting a distributed system makes them much more vulnerable to issues like that as some form of communication is needed for everyday operation. This is much simpler with a central system.