While the hijackers might be able to send a “self destruct” signal remember they want you to pay the ransom so they’re not going to destroy your A/C unit without first warning you about it. Worst case scenario you shutoff the gas & power to the furnace and physically disconnect the thermostat. There should be a kill switch right next to the unit. It’s not a bomb that will explode if you accidentally cut the green wire.
You may be out $100 for a new thermostat if you can’t factory reset the firmware it but I can’t see it doing any real damage unless you allow it to.
