I’m using Ubiquiti at home (a switch and an access point) and self host the controller too.

You can disable automatic updates in the controller and then upgrade the firmware when you please.

Regarding if Ubiquiti have access to our hardware a cloud account is optional so you can just use a local login to your controller instead.

Nothing to stop an instance that was set up just for spam from lying about it of course.

Yep it’s trivial to get a reverse proxy to modify the response to make it look like they don’t have open registration.