Domestic heating systems, as major energy consumers, exhibit significant potential for energy flexibility, particularly under dynamic energy pricing. However, when integrated into smart building automation systems (BASs), they become vulnerable to cyberattacks, especially through data communication channels. These vulnerabilities may pose severe risks to system performance as well as safety constraints. This paper introduces two targeted false data injection (FDI) attack scenarios focusing on communication channels. We also propose operational and comfort safety constraints, targeting proper thermostat function and user well-being. We evaluate both security and safety features in a 4-room Danish family-house with intelligent heating control system. Results reveal that the attacks disrupt energy efficiency, lead to unacceptable user comfort, and violate safety boundaries. This study highlights critical cybersecurity risks in BASs and provides valuable insights for enhancing the safety and resilience of smart heating systems.