Both can be local. They fail differently, and the right answer is usually "both, deliberately."
Zigbee: the sensor network
Built for tiny batteries and mesh reliability. A coin cell runs an Aqara door sensor for two years; every mains device routes for the others; nothing touches your ip network or the internet, ever. Weakness: needs a good Coordinator placed well.
Wi-Fi: fine, if the api is local
Wi-Fi devices with a real local api — Shelly being the canonical example — integrate beautifully and need no extra radio. The catch is the qualifier: most consumer Wi-Fi gear has a cloud api, not a local one. Check before buying (or buy from a store that already checked).
The privacy cut
Zigbee can't leak to the internet because it can't reach it. Local-api Wi-Fi doesn't leak because it isn't pointed there — Shelly's cloud is off until you turn it on. Both pass; cloud-api Wi-Fi fails.
Our default architecture
Zigbee for sensors and battery devices, local-api Wi-Fi for high-power switching, vlan'd if you're keen. It's what the Starter kit sets up.
Skip the shopping list: the Local Starter Kit bundles the tested gear from this guide — cheaper than buying the parts separately.