Android is pretty easy, you just add it to the keystore and that's it. I've had my own CA long before Let's Encrypt, but now mostly only use it for non-public devices that can't easily use Let's Encrypt (printers, switches, etc).
I have my Samsung TV wired to my network only for remote control with Home Assistant (can turn it off if nothing is playing for example). But I force all of its DNS to use a pihole, blocking all Samsung domains. I think I also have firewall rules to also block all internet access on it except NTP, but I don't remember if I still have that enabled or not (there may have been an issue with it disabling something that I needed for Home Assistant to talk to it).
They release pretty frequent updates (monthly), with features added in most of them. It honestly doesn't really make sense to package it with the distro. Home Assistant 1 year ago was missing a lot of nice features in the present version. Plus fixes for integrations that stopped working reliably due to API changes (Ecobee comes to mind), etc.
The best/easiest way to run it is to use Docker. They have a script that will set it up for you. After that, the container can basically self update and self manage. Any addons that you want to use are installed as separate docker containers that talk to the main home assistant container. It's super seamless and easy.
In my case, I just setup a barebones Debian VM and ran their setup script. It took care of all the Docker stuff and got it up and running.