This is true across a frighteningly large swath of “quasi industrial home control” stuff - all the vulnerabilities of industrial controls with zero of the attention paid to it.
All the commercial stuff from before the Apple Home craze. Automated sprinklers, lighting, controls. It’s been out there since the 70s and got rudimentary internet access early on - and lots of it is very slapdash (underlying assumptions that everything is local wire or low range radio from before internet was slapped on).