As long as it's set up so it can only connect to the master thing, preferably on a shielded and separate internet connection, then it should be fine - legally, it's their device.
They'd probably have a few service employees doing regular maintenance and replacements on the road though. That would probably be the biggest expense they'd have after installation, actually.
Another question is what happens if/when they get hacked. Remember: to you, it's a locked box. You have no control over their security - or, for that matter, for the security of whoever may buy the company in the future. Much less them deciding to sell your data sometime in the future. (Remember RadioShack?)
Because there's an astounding amount of data leakage from something like this.
For instance:
Network snooping / spoofing / etc (even if it's on a VPN through an external router it still leaks congestion information!), temperature settings, especially versus actual temperature, power fluctuations, vibration sensors, etc, etc.
I don't particularly want random people knowing - and potentially selling - information about when I sleep, when I eat, when I take a shower, when I'm not home, when I'm on vacation, etc, etc.
They'd probably have a few service employees doing regular maintenance and replacements on the road though. That would probably be the biggest expense they'd have after installation, actually.