Earlier quoted context omitted.
You never needed a bucket of hubs with things like zigbee2mqtt or the Zigbee implementation in Home Assistant. That's enough a proof that the issue was not in the protocol. Actualyl you can also pair between them different vendors products (i.e. Ikea remote with Philips bulbs)
While you could do that, the hub needed to implement the logic to actually convert the different "APIs" that the products spoke. E.g. imagine an IKEA remote sends "button_on" to turn on the light, but the Philips remotes send "light_on" or something. Philips lights will work with their remotes but not with IKEA remotes, since they wouldn't know what to do with "button_on". Zigbee2mqtt and ZHA are great projects that…
Yes you can, I did that with Ikea, Philips and Innr brands. No hub, not even Z2M involved. Yes, as you say they do need to agree on a "protocol" and AFAIK they are all following Philips lead on that, but they can totally work in a P2P fashion without any hub. They negotiate their own key, you just need to pair them with a very close distance (less than 5cm approx).