I think you'd have to write a DNS server where you choose what to return NXDOMAIN for. So updates.samsung.com, sure, let it connect, but spying.samsung.com, block. (Obviously, do not allow connections to any IP addresses you haven't yet approved, which you approve by manually retrieving the DNS entries.) This can be defeated with DoH, or by different business units inside the company cooperating to use the same domain for different purposes, or by doing the TLS negotiation with good.samsung.com but setting the Host header to evil.samsung.com, etc. The first is too scary to ship (you have to keep the DoH's IP address and certificate safe forever; I wouldn't sign off on that), and the second made me chuckle as I was typing it.
I'll add that "back in my day" a screen could display the video signal on its inputs without ever needing a software update. But I suppose automatic time zone changes are a reasonable reason that code needs to be pushed post-manufacture. Then again, who needs a clock on their TV?
I have an unfortunately smart TV, which of I’ve never connected to the network. In general
* it is effectively dumb to
me, so I don’t care about feature updates
* it isn’t connected to the network, so I don’t care about security updates
It hadn't occurred to me that there could be TVs out there that are so “smart” that they can’t even take an input without a network connection. Such a device would be returned as defective by me, but of course I can see somebody deciding that packing it all up into the car is too much of a pain.
I'll add that "back in my day" a screen could display the video signal on its inputs without ever needing a software update. But I suppose automatic time zone changes are a reasonable reason that code needs to be pushed post-manufacture. Then again, who needs a clock on their TV?