@JDRoberts
The Zigbee network is purely in the customers house, in smart meter terminology this is the HAN - Home Area Network. The Zigbee network itself does not connect to any devices outside the customers house. The Smart Meter uses a separate dedicated network to communicate back to the energy provider.
Definitely the Government was either recommending or insisting customers should be allowed to connect their own CAD or IHD devices.
I believe it maybe the case that even the Smart Meter itself is considered to be the home owners property, after all you keep the meter even if you change energy provider.
As per https://www.gov.uk/government/publications/smart-meters-unlocking-the-future/smart-meters-unlocking-the-future#fnref:16 it is intended that customers be able to connect smart home appliances to the smart meters so that energy usage can be scheduled to take advantage of off-peak tariffs, this clearly is not going to be possible or practical unless the customer can do the pairing themselves, otherwise providers will eventually be having to deal with millions of requests.
As I see it IHD and CAD devices only have read access to data provided by the Smart Meter and therefore cannot make changes and therefore are a very low security concern.
Under GDPR principles the data belongs to the home owner.
The RainForest could be connected to either RainForest’s own cloud service or Wattvision. However in the Smartthings thread I linked to people have since managed to have local non-cloud communication between the Eagle-200 and a Smartthings hub using the API. See SmartThings and Eagle by Rainforest (Energy Monitoring) Connection?