What you need is a mini PC with good hardware decoding ability, a linux distro and a web browser.

Many would use a raspberry pi or similar device, as they are quite performant afaik and really small and efficient. Though, they are ARM which means some niche software or even entire widevine DRM (used in browsers for spotify, netflix etc) might not work.

So instead, something cool: you can get a chromebox with socketed RAM on the used market. I have one from Acer that has an m.2 slot, 2 ram slots, plenty of USB and even thunderbolt! And the best part, basically all x86 ChromeOS devices can be corebooted with mrchromebox.tech 's work.

(Using an m.2-to-multi-sata-adapter, PC power supply, sata-to-fan adapters, pc fans, sata cables and a custom rack you can make a NAS out of any of these chromeboxes, which runs regular Linux, can have plenty of RAM and has open source firmware!)

So you not only have a small linux pc, but it also runs free firmware and you can disable the intel ME!

And then some Linux distro with Plasma Bigscreen. It is not full fledged but apparently works good with KDE Connect. But you can also use regular KDE or GNOME (with GSConnect or something newer I cant find).

for streaming (if you really want to endure that) you could use Firefox, or with Brave you could even create Webapps. Those are separate .desktop files and might automatically show up in plasma-bigscreen!

As distro just something that reliably auto-updates. NixOS for sure but manual setup, Fedora Kinoite would work too. A universal blue based TV variant would be really cool (because Fedora cant legally ship patented codecs for h264, h265, aac etc). You could always take the kinoite-main image and layer the additional packages.

Install Kinoite normally, then rebase. Not sure if the first one is still needed.

rpm-ostree rebase --reboot ostree-unverified-registry:ghcr.io/ublue-os/kinoite-main:latest

reboot

rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/kinoite-main:latest

This repo seems to contain all the things needed to configure a base fedora kinoite system to work with plasma bigscreen. A few files and a few packages.

I have a customized onn android tv box from Walmart, it was $20. I stripped out all of the pre installed apps and installed a custom launcher so there aren’t ads on my main screen, just the apps. I also installed smart tube. It’s not difficult to do I just followed a guide.

If you set up whatever, and have it DNS through PiHole or AdGuard running on a Pi, you get a decent amount of protection.

I have an nvidia shield. It’s ok, privacy is dubious.

I’ve heard good things about vero. I’m unsure how privacy focused they are.