I noticed that the device broadcasts an SSID and hosts a Wi-Fi access point. Is that a security risk?

The Wi-Fi SSID broadcast by the Blossom Controller is part of a "micro access point" that the device hosts, used for no other purpose than pairing the controller with your account during initial setup. There is absolutely no connection between access point and your home network. They are separate and distinct, and no packets are forwarded from one network to the other. We are currently working on releasing an updated firmware that will shut this access point down once your unit is setup and working properly. If you would like to have the micro access point shut down immediately, please contact support which can push a beta version of the firmware to your device. We believe that the Blossom Controller is secure and does not pose any special security risk to your home network, but no piece of networking equipment can claim to have no risk whatsoever.