This doesn't surprise me. From what I've seen on the provider side HVAC (and access control) companies want their devices right on the Internet. If you push th

This doesn't surprise me. From what I've seen on the provider side HVAC (and access control) companies want their devices right on the Internet. If you push them they'll deal with being behind NAT with a port forward but mention using a VPN and that's too much work for them. Ask them about security and they hand wave and say it is secure because it is a "appliance" or "controller" as if that magically protects them. This is changing somewhat as vendors move to a "phone home to the cloud" approach instead of direct access so they can get in on the revenue stream between the end user and the dealer. This removes the direct exposure to the internet but the local/insider threat remains.