This is the way. The ‘smart’ is already in home assistant. You need a temp sensor (or a few) and the actuators to trigger the HVAC equipment. There are numerous ‘smart thermostat’ integrations already and modules that handles the PID math for those who want to roll their own.
Any third party product with code you can’t inspect or replace is less secure. In this case, there is no compelling case for a commercial product.