An attacker can get information about the groups of the smart home devices for arbitrary users (i.e., "rooms").
CWE-639