Putting the hacking out of it. Remote centralized control is risky for other reasons. Buggy code or a poor ruleset pushed on a friday afternoon would have the same effect. Its bad practice to put all of your eggs in one basket like this. Not everything should be remotely controlled.

I encountered this on a cheap android tv box off Amazon. Found weird apks and after some digging found it emulated a pixel phone and performed fraudulent ad impressions using my home internet after I turned off my TV.

Returned it and reported to Amazon. The listing was gone in a day and reposted the next. 🤷‍♂️