I wouldn't be surprised if the guy opened his bill next month to discover that he's suddenly subscribed to HBO. It's trivial for the cable company to log those requests and they know who owns which box. An audit would discover his shenanigans immediately.
In the past I've worked on a few IPTV projects. Users would only see channels they were entitled to (unlike Sat / Cable) projects, and there was a heavy CAS layer.
Interesting though. A lot of boxes are essentially just running an embedded browser so there's scope for some poking around.