Modern TVs defintely require updates if you want to get the updates for HDR, DV, HDR10+ specs as well as firmware updates for the local dimming algorithm etc.
I was using the set top box approach (rpi4 + libreelec) with my old TV but the ones supporting the propriatery HDR formats + jellyfin compatibility are usually Google TV as well so I don’t know if that’s any better. Libreelec was lacking in that regard. Coreelec seems to be better but there are other factors to consider.
For anyone looking at this in the future this is the approach I will probably take:
I will be doing both connectivity options. Ethernet for the VPN connection which will be enabled at initial setup and then only to install apps and receive update for apps and the OS. Wi-Fi will be the default connection with no Internet access behind a socks5 proxy server for access to the Jellyfin instance.
The TV doesn’t have a camera. As for the microphones, it has a built in switch to disable the ones on the panel. I don’t know how to confirm they are actually disabled but I’ve yet to look into this.
The microphone on the remote is push to talk. I presume this is to minimise battery drain when always listening. I will also remove the batteries from the remote when the VPN connection is live. Another option is to unsolder the microphone itself from the remote which I will probably do. Or I can get a universal remote without a mic.