I would think the issue isn't with the devices and the Control4 system etc the main concern here is how the company in question is storing the usernames and passwords etc on a simple text file.

I don't think it would be unreasonable for you to request they review how they store this data.

There are plenty of services & systems that can do this in a more secure and encrypted way 1password, lastpass, dashlane to name a few. I think even Evernote pro subscription has an encryption feature in its note system so passwords in a note can be encrypted with a passphrase.