I can't login with advanced protection on. It doesn't recognize the FIDO usb key or the bluetooth key. I can't use my google account which basically eliminates half the features. All they need to do is add the udev rules here: https://github.com/Yubico/yubikey-personalization/blob/master/70-yubikey.rules
Android TV has been a bit... neglected by Google. Sony isn't doing brilliant either, but Google needs to get going and take their own platform serious. Android TV has barely evolved since it's introduction.
As for security updates: it's not great, but it's just a TV. You're not exactly dealing with confidential information on it, at most it knows your Netflix account details and what you've been watching lately.
Other manufacturers with proprietary operating systems aren't doing any better, I'll tell you that... I develop apps for smart TVs at my job and let me tell you, you don't want to know what kind of crap is running on most TVs. Especially Samsungs, the things they do over a network connection...