It is common behavior for a lot of consumer IoT devices. If it goes on your network and you don't control the software, you should consider it compromised. Even if the manufacturer isn't doing outright malicious stuff, it likely isn't secured very well (they never are) so there's every chance that someone else could find it and use it as a platform for malicious activity.