Well legal or not it's because they themselves made the whole setup so troublesome that encouraged this sort of attempts. Right?
All the customer wants is that they want to plug in their own favourite routers into the the BTU switch port. IF you've done it correctly and lock it up no one will one to touch it because they get to play around with their routers instead.
You know the HSBB contract? If you want both services from ISP they'll have to pull another fibre line with another BTU into your premise.
A whole new set of equipment will have to be dispatched to you from your BTU, router and cordless phone all stated in the contract.
I've also never seen cases where you can subscribe both Streamyx and Jaring DSL on the same phone lines. you can do that with FTTH?

QoS? That's already well taken care of with the different VLAN IDs on the ethernet packets. The separate VLAN ID for IPTV is to ensure uninterrupted bandwidth needed for TV when you use the internet.It's already taken care of Bit Torrent sessions never interrupts the TV or the phone.
The strategy they're configuring the BTU is really bad and inflexibly troublesome. That's what I have to say. You don't want customers touching the BTU then you preapre a nice port for them to plug in any router they like.

The FXS voice port is located on your BTU, the L2 port level segregation is already in place on Unifi installs.

Potential ISPs will still follow Unifi's model since they are the owner of the HSBB network. None of them will try to do something funny like routed multicast or encapsulated DHCP assigning with a passive optical network. That'll bring extreme headaches to come. It might get them into serious security issues on a public passive optical network as well with ID spoofing.

That is the extra benefit of point to point active ethernet that PON will never get to have.

A routed approach on a passive optical network will lead to many vulnerabilities.

The intention of this thread is to ask WHY would TM want to lock up the BTU and at the same time keep the VLAN settings of the ports away from the user while requiring them to have a router that have VLAN tagging capability that complies with them?

-Then you have answers coming in and say it's because the BTU can be used by many ISPs who shares the same network with it so it must be locked up to allow the provisioning of multi ISPs on a single BTU allowed only for 1 household.

-Next another person is telling me that his close friend is using 3 different ISP internet accounts on 3 different ports of the BTU by gaining exclusive access to the BTU changing its settings inside.

I'm not saying that router tagging is a problem but why complicate a set up by having additional hardware when you can do it with less boxes?

You can already configure your BTU to provide the necessary ports and accomplish VLAN untagging, I don't mind if it's because you want to provide a wireless access point and internet sharing with the additional router. But why get the router to untag the VLAN services when you can do it already with the 1st device which is the BTU?

I know with Unifi, there are already compliant routers being sold that comes preconfigured to work with Unifi, but how about the other HSBB ISPs?
They need to rely on their routers instead for the FXS phone ports as well as configure their own routers accordingly to work with the different VLAN IDs instead.

Is this some sort of a dirty monopoly strategy that TM keeps itself from the other players? They maintain better support and keeps a simpler setup for themselves in order to stay ahead of competition?

Why am I asking this? It's because there's no official guidelines and VLAN ID lists for all the different ISPs just in case the other ISP users want to configure their routers. They need to keep playing the guessing game, they are stucked with a crap router supplied by their ISP, they are getting different results in different areas. They don't even know which port is configured to have what at the BTU suchas which has port binding to which VLAN ID, which has it tagged etc.

I am not bothered if you can configure your BTU to gain access to 3 different ISPs on 3 different ports or even bind them all because it's ILLEGAL to do so. How you managed to gain access into it is also not a concern probably because it's done by inside staffs.

The only interesting thing I want to know now is what is being pumped out of those ports that you secretly keep in your locked BTU for users to use and why can't you just make BTU pump out clean ethernet packets stripped of their VLAN tags from those ports to make everything simple for everyone?