

What you need is a mini PC with good hardware decoding ability, a linux distro and a web browser.
Many would use a raspberry pi or similar device, as they are quite performant afaik and really small and efficient. Though, they are ARM which means some niche software or even entire widevine DRM (used in browsers for spotify, netflix etc) might not work.
So instead, something cool: you can get a chromebox with socketed RAM on the used market. I have one from Acer that has an m.2 slot, 2 ram slots, plenty of USB and even thunderbolt! And the best part, basically all x86 ChromeOS devices can be corebooted with mrchromebox.tech 's work.
(Using an m.2-to-multi-sata-adapter, PC power supply, sata-to-fan adapters, pc fans, sata cables and a custom rack you can make a NAS out of any of these chromeboxes, which runs regular Linux, can have plenty of RAM and has open source firmware!)
So you not only have a small linux pc, but it also runs free firmware and you can disable the intel ME!
And then some Linux distro with Plasma Bigscreen. It is not full fledged but apparently works good with KDE Connect. But you can also use regular KDE or GNOME (with GSConnect or something newer I cant find).
for streaming (if you really want to endure that) you could use Firefox, or with Brave you could even create Webapps. Those are separate .desktop files and might automatically show up in plasma-bigscreen!
As distro just something that reliably auto-updates. NixOS for sure but manual setup, Fedora Kinoite would work too. A universal blue based TV variant would be really cool (because Fedora cant legally ship patented codecs for h264, h265, aac etc). You could always take the kinoite-main image and layer the additional packages.
Install Kinoite normally, then rebase. Not sure if the first one is still needed.
rpm-ostree rebase --reboot ostree-unverified-registry:ghcr.io/ublue-os/kinoite-main:latest
reboot
rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/kinoite-main:latest
This repo seems to contain all the things needed to configure a base fedora kinoite system to work with plasma bigscreen. A few files and a few packages.























Idk if libreboot is coreboot+ a specific payload.
But in edk2 which is used in dasharo you can set some UEFI boot targets and disable usb boot yes, of course also set a firmware password.
There is also HEADS which is another payload of coreboot and can use a hardware security key to need to approve boot drives. Makes most sense with very stable distros like Qubes though as you dont constantly re-sign everything