Reaffirming my belief that I want nothing “smart” controlling critical infrastructure in my home. What if it were dead of winter, would he have been able to control the heat?
In the US, it's common that the input to each zone controller is just a open/close contact, so in the worst case you can call for heat by shorting the right wires together.
I have a smart thermostat that I use the provided app to control, but one of the reasons I went with it is that there's also an http server in the device firmware that can be used to control it (so if they totally ruin the app or turn off the server or whatever, there's a way out).
It's not impossible that when this happens, they'd also first push out an update to disable the http server.