360
After 16 years, Ecobee is shutting down support for the original smart thermostat
(www.theverge.com)
This is a most excellent place for technology news and articles.
In the last 16 years there's been multiple SSL vulnerabilities, so if someone was motivated enough, they could probably hack it, especially considering they'd have physical access. You could probably even dump out the filesystem and overwrite certificates with your own.
16 years ago was 2008 (which is shocking in itself, I'm old), SSL was seen as very very optional until 2013, when Snowden dropped his CIA/NSA leaks.
I wouldn't be surprised, is the security is "trust me, bro".