Unit 42's write-up on Kimwolf v7 from August has a detail that's easy to skim past. The botnet spreads by misusing residential proxy services to reach Android Debug Bridge on local networks. So your cheap TV box doesn't have to face the internet. If something on your network is working as a proxy exit, whoever buys that exit may be able to reach what's next to it.

Some Android TV boxes ship with ADB enabled on port 5555, with no authentication. Unit 42's advice is to treat these boxes as untrusted, and to disable ADB or restrict it to USB.

I'd also put them on their own VLAN or guest network and scan your LAN for 5555 this week. It takes a minute and it's the one check here you can do without trusting anybody's marketing.

Disclosure: we run a proxy service, so this is our own industry's mess. Curious whether anyone here has found 5555 open on a box they own.