I also didn’t get Internet connected thermostats until the utility company added demand response discounts. It’s really a smart grid technology. This does mean that it should be secured as such, otherwise it’s another vector to attack the power grid (set all thermostats to maximum and cause blackouts). Regulations haven’t caught up.