Users being stupid and not reading what they are signing up for is not a argument against connecting the thermostat to the internet, and hypothetical bad actors

Users being stupid and not reading what they are signing up for is not a argument against connecting the thermostat to the internet, and hypothetical bad actors are just that, "hypothetical". If you'd linked an article demonstrating concrete proof I'd accept it as an "argument against connecting one’s thermostat to the internet".