So i've got this long term desire and fantasies about home automation but obviously it all starts with single steps...
I need to replace my house thermostat anyways so that's coming first. A few X10 modules for lights/presence simulation will come after, and probably working in a few security cameras i'm sure, but before anything else i'm just wanting to start with the climate bit...
One thing i'm concerned about is hacking, after I read stories of how easy it is for an outsider to compromise various things, my top priorities are something that is wired only ethernet, and fail safe. For instance a thermostat shouldn't go sub freezing or shut off a heater entirely, but just control within a limited range (no less than 40 for instance) or maybe change a few programmed statuses. Doesn't really see why it should have unlimited access to do it's job anyways since the biggest thing you're doing is checking the temp when away from home to notice things like a furnace failure/problem in winter, or to tell it to start warming the house up early because you're coming home early from work.
There are a few proprietary heating control systems available here in the UK that do have Wifi connected Thermostats that communicate back to a controller/hub. With these systems you would normally connect to the controller/hub rather than the Thermostat itself. The only generally available 'Thermostat' that uses IP for its control interface is the NEST as far as i know.
However what you are describing are features that are best delivered directly by whatever Thermostat you choose and not by LinuxMCE or any other Home Automation system. Let the thermostat do its basic job - that's what it was designed for and it can do that standalone even if your Core fails in some way (as they do that sometimes!).
If your LinuxMCE system has access to your Thermostat, and can not only read values from it (ie temp, target temp, mode etc) but also send commands to it, then obviously if your system gets compromised from outside any of those settings could be changed. There is only one protection from that that is un-hackable - don't connect your thermostat to anything externally. If there is no interface to the outside world then no one can attack your thermostat without breaking into your home.
Out in the 'real world' though I have never seen, or heard of, any Thermostat that was maliciously hacked so I think in reality the risk is pretty low to be honest.
All the best