IMO, HomeKit support will add an additional method for remotely managing the Iro (that may or may not be more secure than the non-HomeKit method that the Iro has been using over the last four-plus years to communicate over the public Internet). I personally have no security concerns with how the Iro currently communicates over the public Internet.
But … HomeKit doesn’t support Android. Nor does HomeKit support web browsers running on computers.
Unless you’re proposing that Rachio drop support for non-HomeKit devices (by only allowing HomeKit access), the Iro is going to have to keep the original non-HomeKit connectivity method that it’s always had.
Adding HomeKit support to the Iro will be great (not sure it’s a million-dollar feature), but AFAIK it shouldn’t have any effect on the other methods the Iro retains in order to be compatible with non-Apple devices.