I'd say it depends on your needs. Since my home would consume four or five of these in a singe hour, I'd say that they were undesirable to me at any price.
For an application such as my own, a whole-house generator is the preferred solution. It costs as much as three or four of these, but can carry the house for days before requiring refueling.
Yes. You will need to use firewall rules to allow the IPs of the desired services and then deny all other traffic to-from the TV.
You're challenge is that DDWRT only supports numeric IP addresses in its rules, and not Fully Qualified Domain Names(FQDN). So, for your current firewall, you will need to create a list of all the desired IP addresses and then create allow rules for each, or each subnet(range). You'll need to update this list regularly as the individual IPs change semi-frequently.
A Pi Hole might work but it would be prone to leakage, letting undesired traffic pass, and not block hard coded IPs.
If you had a firewall that allowed you to use FQDNs in rules/policies then you could easily achieve your goal. there are several somewhat pricey commercial firewalls that can do FQDN policies. On the free side, pfSense/OPNsense can do FQDN policies using aliases. There may also be others that I am not aware of.
The pictured thermostat clearly lacks an R(h)/RC. So, the answer to your question is; no, not all thermostats have R(h)/RC.
This blog post explains two wire thermostats pretty well.
As you will learn in the blog post, your current wiring cannot utilize a thermostat that requires the R/RC wires for power. The thermostat for your pictured application would need to be self(battery) powered.
Is the DS18B20 missing "rapid changes" or is the SHT30 spewing inaccurate readings? A 2 degree spike from one minute to the next is possible, but it looks suspiciously like a bad/jittery sensor. Especially so for a sensor that claims 0.2c accuracy.
Some of us use a LOT more than that.
But regardless of the number, when planning for comfort, I plan for peak load. Average doesn't help me when I need things to work. I opted for whole-house backup and it runs the entire house.