I have a TCL that I'm happy with. I followed 'some instructions somewhere' to use adb to disable the default launcher and replace it with the ProjectIvy launcher, which is nice and clean and has no ads or promotions (ads by any other name).

Mine _is_ connected to my network, but I have DNS blocking via self-hosted Adguard along with specific SmartTV block lists and regular expressions, plus a firewall for the 'entertainment' VLAN that's fairly tight. I'm also monitoring (and recording to a database) all outgoing traffic on the entertainment VLAN so I can add further firewall restrictions - once I have the time to analyse the logs, maybe after I've retired...