There's a reason that Smart TVs (and set top boxes, and streaming sticks) usually don't allow you to load an arbitrary URL: it increases the attack surface by a

There's a reason that Smart TVs (and set top boxes, and streaming sticks) usually don't allow you to load an arbitrary URL: it increases the attack surface by allowing you to load any arbitrary endpoint on the Internet. When you "cast" from an app on another device you are casting something that app understands is not a generic endpoint, but reference to an object in the app's library. You can disagree with this reasoning. It should be possible to safely load arbitrary endpoints and not ever execute an attack embedded in it. But then it wouldn't be called an exploit, would it?