But how about actuators?
Yes pub-sub pattern is applicable to actuators.
Is this the way to go with actuators?
This is one of the ways to go and this is booming because of many cloud providers like
trying to occupy the IoT space to move data from sensors to cloud easily with different approaches and as devices have limited connectivity, power, bandwidth, they need lighter weight protocol like MQTT and such which is pub-sub model based.
What my point here is any device that can sense and has data can use pub-sub but the smart thing comes from the type of implemnatation they are doing. Suppose if you are not using MQTT over some encrypted mechanism(TLS/SSL) , the data can be sniffed.
Is there any smarter solution?
It depends on the application and the constraints the problem has and the so called smarter solution varies as time flies. One more thing to note here is that, having a smarter solution is not the smartest way to go around, because implementation is what matters the most and not the protocol or method you choose.
Is it possible to publish a open door event from anywhere? How easy
can it be hacked?
Yes, it is possible to open the door from anywhere by publishing an event but this all depends on the application and authentication you are providing, for example you can make your application subscribing/publishing to topics is only after authentication.
Real Case Scenario:
I know a lot of companies who are using this exact model for actuators, recently I worked for a team which is a part of Solar Tracking systems where the solar panels are controlled, monitored using Wireless technologies.
Particularly in that to move/rotate an array of panels according to the sun position and based on different energy optimizing algorithms we use Linear Actuators, in this system we also have a provision to control panels manually from web/mobile dashboards in case of emergencies or any maintenance purposes.
In the above scenario to control actuators Pub-Sub model with authentication/encrytption is used.