TBH the only moderately safe way forward is open source firmware that is autoupdated via signed packages made by individuals with impeccable reputations and verified/audited by others with impeccable reputations.