I agree with sibling phh. Not sure if supported by the ESP32, and it's kind of complex to setup, but I think you could set up a per-device password, with WPA e

I agree with sibling phh. Not sure if supported by the ESP32, and it's kind of complex to setup, but I think you could set up a per-device password, with WPA enterprise (PEAP/MSCHAPv2), and a RADIUS authentication server. What you want to do with that is another question. You can't really do anything against someone who decides to fake your thermostat reading, but having access to the hardware already defeats that. At least you limit the impact to the one device that was stolen. Having someone check that the device is still there could be helpful. And since that attack still takes some time to perform, some monitoring could detect that the thermostat/etc hasn't been connected in a while. I am not sure how useful extracting a Wi-Fi password that's only used by the doorbell would be?