A phone call from the HVAC company and physical thermostat dial (in a locked cabinet to prevent incompetent/malicious employees tampering with it) seems a safer solution.
I think the cost/benefit equation is gonna collapse in the era of AIs exploting vulnerabilities at scale, but it's not like there's zero theoretical benefit of this capability on its own.
Take away the security aspect and centralized management is just so much easier and reliable. Humans suck at doing things they were supposed to.