I secure my TV by keeping it off the internet. In doing so, I sacrifice some "free" content, but so it goes. You may or may not have an option to disable it from broadcasting it's presence via Bluetooth: I saw no obvious way to disable the feature on my Samsung set. But they do make it easy to change the device name, and since giving mine a non-generic name, I no longer have random people attempting to connect.
400 USD will get you a Samsung 32" 4K HDR QLED set, and the last time I checked, no one else offered all of those features in 32". I have a similar unit which is now a few years old. Minor gripe: They reduced physical controls on the unit to a single button, and after a couple of years, the plastic outer shell broke off, rendering the button unusable. I found someone selling a replacement part, but ultimately opted for a DIY fix, and it's been fine ever since. Mine came with a sleek, Apple-esque remote control which works well. But if there's a hidden service menu, I see no way to access it via this remote, as it lacks a numerical keypad.