When the "Internet of things" became another M$ phrase I just thought cr*p, as I had to learn of it, to be safe. I like to be ahead of the game and a fairly good computer user till recently.
A story...
I use a ASUS R66U router and doing a whois, damn if Asuswrt-Merlin wasn't on my system; is was open to where I had my pants down on the Internet. Merlin did send me a note (to a private computer that had no web pages to view) to take care of the problem but his software was the cause.
Follow my post and see I supported and had open Internet lines, they were hacked and for two months my system belonged to someone else. Sometimes I could access it, other times nada, so kept it on for those up times and continued to contact Charter.com who suggested I might learn more or even call the Geek Squad, a slap in the face.
I even ordered another computer system from Newegg as mine was fairly dead, due to the free Internet users that took over my system.
Now this hacker found or added ( there's no telling but I might have to explain that to a court) that offended them so they reported me to 911, I had Swat looking for my drives that I hid earlier as the hacker himself bragged so much he posted his name, I had him for slander -Swat, I have no clue what they were looking for. I was a neutral in my own house and watched Swat search my place (very professional).
No charges yet but time will tell.
My story is to say you must be better now, your systems are hackable; this thermostat is controlled by your computer, so from thermostat to computer.
Be better, I had never been hacked till this time (35 years) and had no clue - maybe Asuswrt-Merlin was watching for a hole, I had damn threads on my system and Merlin's job was to block their entry. He lost I don't trust his software anymore.