They could, but the person who's actually making the decision on which vendor to go with will most likely choose the ones that allow for remote management because they think it'll allow them to cut staffing

In the end the market will optimise for that guy's opinion, not the optimal solution

You probably need admin/write concepts in order to change users, rotate keys, allow/disallow IP ranges, network setup, etc....

Still totally agree that there should be guardrails around the core functionality but it's easy to imagine that the thermostat would be something one would expect to be able to control once you implement all this remote functionality.

You need none of that if it's truly broadcast only. The network or receiving system can be configured to accommodate the device. A hardware button and screen on the device can be used to regenerate a key, although that is probably necessary.