Have real ad blocking in the browser.

(which would mitigate a lot of security risks by itself. I also note that people seem to do fine with desktop OSes, despite their outdated security models)

Also, a working foss ecosystem.