This is why I put devices I do not trust (like these kinds of boxes) on a separate VLAN. My access points advertise a WiFi network with client isolation that can only access this VLAN. There is one hole in the firewall from it's subnet to my Jellyfin server. The DNS server for that subnet has a whitelist for some of the streaming services on my TV and internet radio, and nothing else.