The eQ-3 CC-RT-BLE is a decent electronic thermostat with bluetooth low energy support. But everyone who ever used python-eq3bt should have noticed that the devices don't need any kind of pairing. It was therefore possible to talk to them (when in range) without any kind of authorization. The pairing PIN used in the calor BT app was only verified inside the app itself - most likely as an additional check to avoid adding the wrong device.