You know how you shouldn't download apk and apps from untrusted sources? Same logic.

All they need is access to your device, and then to your network and then to your other devices in the same network.

If your network is relatively secured and prevents lateral network (communication within same network eg pc to pc, in this case tvbox to pc) you are relatively safe except for when threat actor decides to use your tvbox to DDoS, and your IP will get flagged. This is best case scenario.

If your network allows for unsecured lateral network communication, the tvbox will try to hack into other connected devices.

put it on a different network segment and disable inter-segment communication, not a straight forward operation though, so it's not an easy thing to do with most consumer grade routers