At least in the case of my thermostat, all remote functions are mediated by a server on the thermostat company's side that dials into the thermostat over the We

At least in the case of my thermostat, all remote functions are mediated by a server on the thermostat company's side that dials into the thermostat over the Web. In order to compromise the thermostat, you'd have to know how to identify my thermostat and how to spoof the server it communicates with. It's not like you can just stand outside my window with a fob that has an antenna and a big red button and turn my heat up. From another perspective, front doors with deadbolts and residential don't have a good security track record, either, since most of them can be kicked open easily. But they're good enough.