Hacking - Like i said, it will be operated from home assistant, and I'm not worried about that being hacked. The device can be hacked directly by someone sending random messages with a compatible NRF24 or other device somewhere nearby. I'm not really sure how to handle that one, as this sort of communication is broadcast and a verified message would have to change content every time to be secure, sort of like a rolling code.
So . .. . above, I said that ProMini with batteries was the simplest, but you may want to move to a 32 bit controller for this one.
MySensors provides a security framework to address the hacking aspect above. Using signing on a complicated node, I started running out of memory on the ProMini. I have moved to the NRF5 series, mostly to get more memory. There is a lot of additional features and power also, but it is a harder learning curve to get the tool chain working.