My Synology NAS has some cloud like services but it does not require any external services to work. Just the way IoT should be.
Well, that's a problem with centralisation. There's no reason that you shouldn't be able to connect directly & securely to your thermostat, or access it indirectly & securely via your router or home server.
Among the issues of doing this are asymmetric Internet speeds and NAT, but those are solvable.
I do not want (most) IoT devices to be controlled directly over the Internet. For some it may make sense to do it like that, like say for surveillance cameras, but stuff like routers or coffee makers should be controlled locally.