As part of my commercial energy reduction business we install network capable network communicating HVAC thermostats similar to Rachio Iro2. Same concept for the tstats: control and scheduling via Internet.
Rachio will have to move to firmware updates at user control if it wants to make a significant penetration to commercial markets. No (few) commercial or municipal properties will allow a manufacturer to sight unseen automatically load a firmware update.
Rachio wants to insist that its customer base is always using one version of firmware - this minimizes support costs. But it requires customers to accept automatic firmware updates without having opportunity to delay it to first understand what it's for.
My guess is for the residential market no opportunity to intercept a firmware update is no big deal. This changes substantially so in the commercial market. After Rachio gets some things done, and then decides the commercial market is attractive, they'll have to fix this.