I think it’s worth mentioning that this vulnerability really exists when the ISP has not separated duties of the physical devices well. Most PON networks do not

I think it’s worth mentioning that this vulnerability really exists when the ISP has not separated duties of the physical devices well. Most PON networks do not use the ONU as a method of deciding which service the user should receive. This is instead usually defined by the PPPOE session and the characteristics sent by the RADIUS server. Having zero upstream authentication beyond an ONU serial number, if that, is poor and unusual network design. If you’d like to understand more about good Ethernet based broadband network design, you should read the reference standard TR-101. This evolved from TR-099 which was the old ATM/ADSL standard.