So I'm speaking as a Network Engineer. WPA2 is clearly your best bet, but use a strong password. I personally set up a SSID exclusive for my home automation and put it on its on VLAN. The key I use for that has never been shared with anyone, and is only used by my home automation equipment.
I do however second the idea of hard wiring ethernet. Everything in my house that can be used over ethernet, is. I paid $500 just to have the Ring Elite since its hard wired, and poe. But with the power requirements for the sprinkler system, PoE wouldnt be an option with the Rachio.