I have a Z-Wave Schlage Touchscreen Lock, when I discover the lock from the smartthing app. I can add the lock without any authentication and get full control of the lock. I don’t understand how security work? is that mean anyone with a zwave hub can connect to it to get control?
To get a Z-Wave or ZigBee discovered, you need to have physical access to the lock to press join button or need to input the admin code in the lock keypad. Many devices (but not all) will issue a “Tamper Alert” if their case is opened in order to access the reset button.
Once a Z-Wave or ZigBee device is joined to your Hub (which can only be done when you put your Hub in join mode, or put the Z-Wave network in join mode using an already joined secondary controller like a mini-mote), it cannot be joined to a different network/hub without being reset or “excluded” from the first network. This doesn’t require security, but does require physical access. See #1.