Ok, yeah, I think your last sentence is probably where I was thinking…
Yep, repo packages are going to be fairly good except for watering hole attacks, but PDFs and other documents could be a potential source of malware that anti-malware software would - potentially - protect the user.



Get 2 devices, set them up the same and put 1 in a cupboard.
When you make a change / update and / or the hardware fails, then you can still recover.
Personally I have a Fritz router in bridge / pass through mode, then a pfSense firewall - basically a low-ish power microATX (I think) PC - which does all my adblocking and DNS as well as reverse proxy for home assistant, etc.
Works well. But I had a SSD failure once and that was difficult to live with…