I don’t disagree with you on shitty UI, but I’m going to question “a treasure trove for thieves”. I just don’t believe there’s some sort of house thieve’s Union running attacks on boiler infrastructure in order to work out who’s on holiday this week, especially given the low penetration on those things meaning you’re going to get visibility into one in a hundred homes. It just seems so low value compared to driving round the block for a few days and seeing who’s car hasn’t moved.

This is an important principle. If essential systems in everyone's homes start depending on remote connections to work and/or including spyware that phones home with any kind of data about how the system is being used then that's a serious security and privacy concern. It's bad enough that we have metered supplies of various utilities and instead of the old "agent pops round to read the meter every few months" we now have smart meters phoning home with metrics every few minutes. At least the metering is there for a legitimate reason and the change to smart meters does have some real advantages including for the homeowner so the risk is more an unintended but unavoidable side effect in those cases. Almost everything else that goes under the "smart home" banner seems to be like smart TVs and connected vehicles: if it's phoning home then it's a good bet it's doing it for their benefit and not yours.

Driving around costs gas and time every time you go do it.

Compromising the centralized server is a one-time cost; once you've snuck something in there to regularly send updates where you can see them, you get alerts on those 1/100 houses that are rich and dumb enough to pay for this overpriced "smart" boiler. Maybe you can even work out a way to let people all over the world subscribe to these updates for a fee and let them take the risk of actually breaking in and fencing stuff.

Heck, you could even hack your way into a bunch of other smart home servers, and bundle all of that up into a nice little darknet service offering regular updates of stuff like "everyone in a 20mi radius of a given point who is setting all their smart stuff to vacation mode". That sounds like it might be a pretty nice passive income stream if you don't care about the very obvious legal/ethical issues involved.

And maybe your nice little darknet service could also let people say "hey, do you know anything about jon-wood?" and reply with "why yes we do, here's a few hints, would you like to pay for more?".

The risk/reward calculations on this might only work out if you're a regular employee of a highly-organized crime ring instead of the mysterious hacker running a darknet site that serves as one of many hubs of a decentralized crime syndicate, I dunno. The hacker sure makes for a cooler story if you're writing a techno-thriller or a cyberpunk novel though. :)