I would assume it's the former, but in the case where there's multiple thermostats hooked up to the same shared IP it might show you a list of all unowned devices and then ask you for which one you want to activate, and then telling you to go over to it and confirm. So in the scenario of the apartment complex you wouldn't get everyone's thermostats, just the unowned ones, and even then you're limited to choosing only the ones you have physical access to.
