Don’t give your power company access to your thermostat and you don’t have anything to worry about. These people willingly did this to get deals from their provider. It’s not like they took control without asking.

Also, local open source systems such as Homeassistant exist. You can have smart stuff while keeping full control of your data and privacy. It just takes a bit more shopping around for devices which don’t “phone home” or ones you can hack with custom firmware (Tasmota, ESPHome)