I was hoping this would be an elaborate side channel where the data was exfiltrated bit by bit over a few weeks by inducing temperature fluctuations that were picked up by the thermometer that was visible through a window from the building next door. But it's just another "IoT" device. These things should be considered backdoors until proven otherwise.