I'm confident the actual auth/crypto is terrible, so a dedicated attacker can do this even with GPON (through a rooted conventional GPON ONT). The security is

I'm confident the actual auth/crypto is terrible, so a dedicated attacker can do this even with GPON (through a rooted conventional GPON ONT). The security is mostly provided by the fact that most internet is cheap enough that the mere price of acquiring an SFP or GPON ONT + the time it takes to reverse-engineer and hack isn't worth it. Also, breaking into unterminated fibre itself requires a fusion splicer that will set you back a couple grand, which is enough to pay for 1+ years of internet in most places. Same with DOCSIS, the security is mostly obscurity/annoyance but anyone dedicated will easily bypass it.