

@Toes@ani.social is right about Android 9 being horribly insecure. There are a bunch of unpatched CVEs that can allow an attacker full access to your phone, and since even browsers have dropped support for it, you’re going to be lacking protection against modern attack vectors.
If you only use your phone to browse a couple of websites, going into uBlock’s settings and disabling JavaScript will provide extra protection against malware. When you want to allow a site through, just click the uBlock icon and enable JavaScript for the site in the pop-up, then hit the padlock (to save it as a rule instead of being temporary) and refresh.
It’s like NoScript except it doesn’t require another add-on and it’s much easier to use. The downsides are that the control isn’t as fine-grained and it’s slightly less secure (as it’s a binary allow/block for everything on the site, whereas NoScript lets you block individual scripts and third-party domains) - I don’t think it’ll protect you from a trusted site that’s been infected with malware itself. If you’re comfortable with nearly every site being broken without manual intervention, go with NoScript instead for the extra security.
There are also anti-malware filter lists in uBlock’s settings. I can’t recall if they’re enabled by default, but it’s worth checking. They’re a simple change that provide excellent protection on their own.











Back when I used Samsung, the custom ROM scene offered stock ROMs with all the crapware removed - usually labeled as “debloated”. If you can find them, those should allow you to update with your S-Pen still working. You can also debloat Android yourself (sort of; without root it just disables packages rather than uninstalling them) using UAB.
You’d lose KNOX though, and a lot of modern apps deliberately break themselves if you’re not running pure stock (or spoofing it, which I can help with if you want to go this route).