I should note that I think this whole thing was handled poorly, and I think there's a lot of room for our entire industry to come up with some best practices surrounding sunsetting (and, in my happy place with free ponies for everyone, mandatory open-sourcing of the backends needed with clear instructions for how customers can switch to running their own. But that's my free pony land.)

But that said, I think it's more than that. There's no such thing as autopilot on the Internet, particularly for a company that deals with customer PII (and I count the ability to control stuff in your home in that category. :-). You can imagine the rathole -- we've all been down it a few times: You need to upgrade the kernel/libc on your EC2 instance because of the security vulnerability du jour. But libraries X and Y won't run after the upgrade, so you need to upgrade them. But the developer of those libraries changed the interface, so now you need to... yadda, yadda. One or two of those changes you can probably just hack in, but depending on how disgusting the codebase is (and let's be honest here - it was an acqui-hired startup that was probably in panic mode towards the end!), at some point, it starts looking like a choice between a total rewrite or tossing it to the wind. Suddenly that takes you up to an FTE, who in the valley is going to cost you >= $20k/month. Then you divide by the # of still-active devices (I have no idea what this # looks like) and suddenly it looks like a big resource drain for no benefits.

(Imagine, for example, that the engineers became aware of a firmware-level vulnerability that exposed all customer devices to remote exploits and control -- and somewhere between the acquisition and then the build system for rebuilding and testing the firmware had gotten screwy. Or the last set of test devices in the lab finally broke. Or that, plus it turns out the remote firmware update mechanisms had never worked in the first place, and fixing all the bugs would require not just fixing them, but actually creating and deploying an entirely new update path. Or, or....)

Of course, one can wish that were the case something like that, it had been communicated. My fingers are crossed that maybe Nest - and other companies - can use this as a learning experience and come up with policies, with teeth about acquisitions, governing the sunsetting of cloud based services that are essential for the operation of customer hardware. I'm not optimistic yet, but I'm glad to see the EFF raising the issue.