When I had them hooked into my EV, I literally had to change my Kia password when they ignored my requests to disable the feature.

Presumably they similarly have some sort of cloud permission into your thermostat, which can be disabled by changing the password, resetting the device, or worst case scenario, get a new thermostat.