The NEC says:
90.3 Code Arrangement. This Code is divided into the introduction and nine chapters, as shown in Figure 90.3. Chapters 1, 2, 3, and 4
apply generally. Chapters 5, 6, and 7 apply to special occupancies,
special equipment, or other special conditions and may supplement or
modify the requirements in Chapters 1 through 7.
Assumption is your thermostat control system, like most, is a class 2 control circuit by definition in Article 725. So rules in Chapter 3 apply, as modified by Chapter 7.
Box requirement is found in chapter 3
300.15 Boxes, Conduit Bodies, or Fittings - Where Required ...Where the wiring method is...nonmetallic-sheathed cable, or other
cables, a box or conduit body shall be installed at each outlet point,
switch point, conductor splice point, conductor junction point...
So the general requirement is a box is needed for splices, but the Article 725 which modifies chapter 3 articles says:
725.3 Other Articles In addition to the requirements of this article, circuits and equipment shall comply with the articles or
sections listed in 725.3(A) through (E). Only those sections of
Article 300 referenced in this article shall apply to Class 2 and
Class 3 circuits.
300.15 isn't referenced in 725, so a box isn't required.