Amazon I believe recently asked a number of custom skill makers to remove unlock functionality from their code for this exact reason.

Could someone walk by my window and say "Alexa, set the thermostat to 90 degrees?" Sure. That would assume the attacker knows I have a smart thermostat, also they have to know the name of the thermostat in my app.

Also, my heat would have to be on for it to really matter, and at the end of the day all it is really doing is increasing my utility bill.