To be fair, their entire threat model was likely "who TF would want to break in to change the settings on a thermostat on a fridge at a grocery store".
A valid question which has yet to be answered (at least not publicly).
Some threat actor that demands quick payment or their perishables perish?
Some threat actor that demands quick payment or their perishables perish?