Can the alarm hub have made this download?

Can the alarm hub have made this download?

I have received this message:

Your Apple Account, ..., was just used to download Yale Smart Living Alarm on a computer or device that has not previously been used. You may also be receiving this email if you reset your password since your last purchase.

If you initiated this download, you can disregard this email. It was only sent to alert you in case you had not initiated this download yourself.

If you did not initiate this download, we recommend that you go to iforgot.apple.com to change your password, then see Apple Account: Security and your Apple Account for further assistance.

Sincerely,

Apple

I have changed my password, and not by using the links in this message (in case it is a scam). Apart from someone breaking into my system, the only thing that I can think of that can account for this message is the following.

I have recently installed an app from Yale on my iPhone and registered my alarm hub with it. The hub is connected to my router, so is a device on the internet that might know of my Apple account from the app I download using the account. Could the message result from the hub downloading updates as an app? If this is the case, can I be assured that the message is nothing to worry about?

It would help if there was a way of finding out which device made the download, but, from what I have read in other posts, Apple withhold this information to discourage it being used to keep track of who is using an id that is being shared, because Apple wish to discourage the sharing of ids (which I have no wish to do myself).