> such devices often run on outdated Android versions, which have unpatched vulnerabilities and are no longer supported with updates.

Many of them NEVER received a single update ever. There are so many shady companies producing TV boxes with no plan to ever provide any updates.

Unless one of the larger brands make such a device, I don't see any reason to recommend anything but the ChromeCast or whatever Google calls it now. Or a Roku or an AppleTV, if you swing that way.