@easytodobetterIt is an inexpensive android yes but it has the backing of walmart and you can make the same argument against any other competitor, or Roku itself. I don't think it stands up for a couple of reasons. First, unless you're going to roll your own media box on something like an odroid N2, pi, or something like that (I have those laying around on desks now), you're at the behest of whoever is providing updates. You're right to think this way, and I wish more people would, but I think it's a non issue.
Let me explain why...
We're trusting Roku now, and they're nearly 10x as small as walmart and 25x as small as google. This is an in-house walmart brand (don't get the knockoff on amazon) and they (onn house brand) is responsible for updates to the firmware, but google and the streaming providers are going to be responsible for the security of the underlying major OS components outside of base OS image and the individual streaming apps. The same way an android phone gets google play services updates and core component updates over the air from the app store and a samsung device gets updates on the base android install from samsung. Now ONN isn't going to use some strange fork/branch of android, it's a google TV/android tv certified device. I agree if we're talking about some rando box from alibaba, but we're not.
The bottom line is, and this is the same for roku, is the device is behind most people's ISP or home router firewall on an unrouted RFC 1918 network most likely, so the security concerns outside of local network stack exploits from other infected devices on the same network, is going to be a vector that involves TLS protected transport to "thought good call home" services such as the play store, google, and the various streaming provider's own network via their apps. In fact, the largest vector of attack would be not updating the OS in a while and running a browser on an attacker's website. That is a non-zero threat in and of itself, but I don't think that's what we're talking about.
In general, the threat surface of these devices for most people is pretty low just because they're using constantly-updated google / android services and play store apps. People are far more likely to get owned via their android phone than these boxes once you get from a reputable source. The primary threat of cheap android boxes is where you get them, IMHO.
