I fully agree.

But to be fair, in a other comment someone linked to a website [0] explaining that the app could be used without connection to internet. So in this case perhaps Bosch didn't have as much of a malicious intent as originally thought.

Quote from the link:

  However, [..], the BSH "HomeConnect" appliances have a no-cloud mode built into their app without any hacks required to disconnect them from the internet. They do require a one-time connection to perform key exchange of a long-live authorization key, but from then on the appliances can be operated entirely disconnected from the network.