"Could YouTube ads be an issue? Surely they don’t allow js in tvOS ads."
I don't own tvOS, but ads, browsing the web or apps supporting iframes/web content (a lot), are a well know exploit vector - being used quite effectively by malware writers a few years ago. But today, federal, intel agencies and the military took over the market. Everything is more expensive.