You probably need admin/write concepts in order to change users, rotate keys, allow/disallow IP ranges, network setup, etc....

Still totally agree that there should be guardrails around the core functionality but it's easy to imagine that the thermostat would be something one would expect to be able to control once you implement all this remote functionality.