There is a problem with this that we are aware of, and intend to fix in the next release. What is supposed to be returned should be a JSON Object. But what is being returned is an improperly constructed String that sort of looks like a JSON Object, but isn't.
The fix for this is for us to correct every thermostat driver. That in turn means that every app that uses this attribute (and supportedThermostatFanModes) has to be updated to deal with the fix. Right now, all of these apps are manually parsing the string value into a list. They should be able to use parseJson() instead. We plan for this fix to be in the next release (2.3.3).
In the meantime, you can take the returned string apart by removing the brackets, and doing tokenize(",") to get a list of Strings.
