You’re assuming that all thermostats don’t have storage. The fact that the smart device has a download function kind of implies that a firmware update is involved. Unless there’s a specific “reset to production mode” button, I doubt that you’re going to get around the ransomeware that way.
The truly scary part of this hack is that once a destructive sequence is sent to the system, removing the thermostat won’t necessarily do a damn thing. The A/C can be manually deactivated by throwing the great-big switch that should be installed close to the condenser unit, but turning off a furnace requires turning off the gas or fuel line. If it’s running out of control, that’s probably the last place I’d want to be.
