You probably need admin/write concepts in order to change users, rotate keys, allow/disallow IP ranges, network setup, etc....

Still totally agree that there should be guardrails around the core functionality but it's easy to imagine that the thermostat would be something one would expect to be able to control once you implement all this remote functionality.

They could, but the person who's actually making the decision on which vendor to go with will most likely choose the ones that allow for remote management because they think it'll allow them to cut staffing

In the end the market will optimise for that guy's opinion, not the optimal solution