Have you not heard of the immensely popular man-between-the-first-hop-attack where hackers physically attach another hop between your server and its gateway?

Even in that joke scenario it doesn't make sense, since those attackers control the MAC layer already.

No, I've only encountered (wo)man-unplugging-the-first-hop. It leads to a lot of dropped packets and impacts all connected peers of the first hop.

I'm guessing to auth client devices (i.e this is my laptops Mac address, allow this)