From the toaster you'd still need to find a way to access a trusted device. This is going to require an exploit. But first the toaster needs meet some specific requirements, like does it have a web server or shell. If it's a simple device that merely broadcasts its state it likely does it meet these requirements.

If your WiFi thermostat is broadcasting its default SSID, that means it is not connected to your WiFi. At most you can take control of the device but it won't get you onto the trusted network any faster than hacking their WiFi directly. Best to go for a device already on the network.