Gee, I bought this cheap made in China Android TV thing off Ali express, and I just can’t figure out how this backdoor got in here…

RethinkDNS (available on F-Droid) has a mode where it blocks every connection by default and you have to allow each app to access the network. I used that to effectively disable the pre-installed malware on my Android TV box (X88 Pro iirc). It also has DNS and connection logs to check network traffic (can be a lot though). GlassWire (Play Store) is nice to quickly check for an unexpected amount of network traffic. Not sure if there's ways around that, but it worked in my case a while ago.

Further, while only licensed device makers are permitted to modify Google’s AndroidTV, any device maker is free to make changes to open source versions. That leaves open the possibility that the devices were infected in the supply chain and were already compromised by the time they were purchased by the end user.

It's ArsTechnica, so I wouldn't think they're intentionally spreading FUD around FOSS, but that bit did live a bad taste in my mouth.

I have a MiBox, I wonder if its vulnerable

this is a nothing-burger. the same "article" from days ago, rehashing the same bullshit, quoting a totally unknown security researcher firm (that, conveniently, also sells some turd that's gonna rid you of this scourge) with zero details, followed with less than zero fact checking from arse technica, like how did they establish the 1.3 milsky number, the "infection" vector and other similarly "unimportant" shit.

portals like the mentioned arse thing are hungry for content and are willing to publish any old thing that even resembles quality content. keep your eyes open, your wits about you, and question everything.