Maybe it first worked like that, but it's certainly no longer the case in newer versions. I've personally compromised a not-network-connected TV using only broadcast signals.
HTML+JS can be pushed via the "DSM-CC object carousel"
Funnily enough my memory of trying to implement the DSM-CC specs is that they are broadly equivalent to a denial-of-service attack on your brain