Just trusting them to pay you out of their own pocket?

Assuming US, it actually depends on the state (may be all states, but I can only speak of those I’ve lived in). The law is that the money must go into a separate interest bearing account and that is the money that is to be returned. So the money isn’t supposed be their own pocket.

It is wholesome. A family in the film even stops to watch the miracle of life.

The first step is buying devices from reputable vendors and trustworthy resellers to minimize the likelihood of malware being pre-loaded from the factory or while in transit.

Given the size I suspect this is also a common attack vector.

Also,

Android TV devices should have their remote access features disabled if not needed, while taking them offline when not used is also an effective strategy.

Is this a thing? Why would a TV have remote access features?

Unless I’m mistaken, none of those will block server-side ads.