Is it good practice to use an ESP32 DevKit in a product?
I see this is an old thread, but this is worth mentioning.
First, the OP asks if it's OK to just use an off-the-shelf dev kit, NOT the module it has mounted on it's back. I would refrain from this, as you have absolutely no control of availability, quality, EOL notices and price.
Using the module, however, is another story. The module has been certified by various standards agencies for compliance with the various standards. It contains the Espress chip, and a few other components that have been assembled according to a controlled document and can't be altered without loosing that approval.
As far as conspiracy theories go, it can be done in so many ways that it'll never be detected without detailed analysis in an NSA level lab. The security camera products are the best example.  They sit up there looking at what's happening, but that's not the danger. If you put them on the inside of your firewall, and on your secure network, they have all the time in the world to probe that network. Being an inside &quot;trusted&quot; device, they can send emails out about what they've found. They can even ask for updates of their firmware, or receive new code from time to time. Often the update account is hardcoded, so the admin can't change or disable it.
We lazy developers can download &quot;free&quot; modules from Github to make our high pressure, zero schedule, projects get done on time. Seed back door code, cleverly hidden in self-modifying subroutines, can hatch a spy application in code domestically written. Be careful about downloaded modules in wireless or network code.