Well, there is some work to do with identifying the device in your network (which shouldn’t be the problem) and monitor the connections over a specific time. When (as happened with ECOVACS) a single device frequently connects to DNS and HTTPS reaching a single IP belonging to this vendor, this is regulated quite easily with a proper firewall. Without the insights, this is (like you wrote) difficult to accomplish and yes, there may be false positives. Also separating those devices within an own VLAN could be part of a (individual) scenario.
Samsung mostly talks to specific hosts, LG does as well and searching for firmware triggers different targets. These are easy to find if you know what you‘re doing but this depends on setup and knowledge. It‘s a hare-and-tortoise-race though.
The safest way would be disabling the WiFi or LAN-connection if you don“t need any of the services shipped with the devices but while this may work for TVs, it may make your Vacuum Cleaner useless as the specific app for that device won‘t work anymore.
Still like the idea behind it and wish there was support for GrapheneOS (going even further than /e/o) as well as better camera quality but this is the price we have to pay for flexibility and sustainability I think. Like the concept here but never tried to go with one so far.