They definitely need to figure out something to mitigate the public information bit. Aside from (presumably) a cost associated with it, there isn't anything stopping someone from going to the DMV and getting the info they need about a target.

Further, they also really need to change the HTTP method for the endpoints that change state.

Nothing's stopping someone from putting up an image tag on a well-trafficked website (or buying display ads on a network) with the src set as the endpoint that turns on the AC. Turns into a real-world DoS when the battery is dead.