1. It doesn't come from physical access to the device: the device is accessed wirelessly.

2. The water company collects all this data from everyone with the device.

3. As the Mirai botnet showed, it's not just the government who might have access to that data.