No, I want security updates without surveillance, without lock-in and without a monthly fee.

Sounds like too much to ask?

This is what Linux distributions has been providing for decades. And my 486 PC was less powerful than some thermostat.

SaaS gets hated on too much here. The incentives work out as well for desktop software - there's no longer the incentive to add new features to justify customers purchasing a new version (or withhold features until the new version). The problem I've seen is that it almost always comes with a big price hike when compared to an alternative of upgrading every 3 years. The only exception to this I can think of is Office 365 which still remains a deal.

Its a fucking thermostat.

I don't need the company to be bankrolling a $2mm/yr AI team so that the thermostat can try to make better guess about when I want to turn on the heat.

You don't, but they do. By analysing how you use thermostats they may figure you need an AC and sell your profile to AC makers.