Not good enough. Any OTA updates your TV can get over the web will eventually be trying to circumvent your IP blacklists to shove in any ad-riddled garbage they can.
Literally just blacklist your TV’s MAC address, and use a dedicated set top box of some kind to avoid this shit. My current choice is my NVIDIA Shield Pro 2019, which I installed a 3rd party WOLF launcher (there’s also F-Launcher) and turned off auto-updates so I could avoid NVIDIA and Google doing the same.
At some point, I will probably need to switch to a NUC or other HTPC with some flavor of Linux on it, as eventually the Shield may succumb to this shit as well.
And Earthbound.