I thought Android TV is malware but I guess that’s not what the headline means.
There’s a lot to be said for firewalling these boxes, either from your internal network or from the internet or both. Firewall in this case doesn’t necessarily mean blocking all traffic, because for some boxes that would render the box useless or unacceptably degraded in functionality. I mean whitelisting traffic down to the bare minimum that you believe is legitimate. That could have the effect of preventing its use as a botnet.