Yeah, but:

The downside, though, is that installing the ransomware, currently, requires the hackers to either have physical access to the thermostat or trick the victim into loading malicious files on the device on his own.

And if a hacker is in your home, they’re not a hacker. They’re just a burglar.