How does this work? Are those TV boxes not running behind routers with firewalls?
What makes you assume the vector is an incoming connection? Routers and firewalls won't protect a device from a user lured into installing malware with promises of "free Netflix, completely legal" running off some pirate mirror, or simply wrapping stolen credentials (note how people trying to break into your computers can not always be trusted with legal advice). And neither from simply luring them onto some maliciou…
The sheer number of compromised devices does. Sure you can trap users with malicious streams and malicious apps. But I find it surprising, that those actions alone can catch so many boxes.