This is actually what I want. I have All of our IoT devices, including the thermostat on their own VLAN, this helps protect my Private network. I have a local VPN server which I access our devices remotely through via HA, BUT here is my concern:Just keep in mind that just like CCTV cameras, you really don't want to give your thermostat access to the internet or expose it to remote access from the internet by port forwarding. This is another use case for a self-hosted VPN. If you can use a mobile device to control the thermostat while on your local network, a VPN will allow you to control it remotely as well. This means a cloud service or subscription is not needed or really wanted.
Call this next statement crazy, paranoia, conspiracy or what ever but with all of this Climate Change insanity/nonsense push I do not want to be controlled. I know most of us are on Smart Electric meters (Grid), which also can be controlled, but I just don't want to end up being punished because of our thermostat setting.
A utility company locked thousands of customers out of their smart thermostats in Colorado
An epic heatwave is suffocating the western US.
www.theverge.com
Maybe the above is just my ignorance but I will sleep better at night knowing I have not freely given access to the companies who made the devices of which I own through the Internet, having the Thermostat connected via Z-Wave sounds good to me.