[the_mitsuhiko]

> In theory the ONT can act like a listening device

Sure, but so can the other endpoint. Even many AON installations these days are just hidden XPS-PON and similar, you just never see the ONT. (See a lot of ISPs in Switzerland)

[bobmcnamara]

And so can all the other endpoints if they're not encrypting downstream traffic