I'm undecided as what to think of it. On the one hand, it's a piece of equipment in my house which I can't control. [...]
On the other hand, the box is clearly a part of *their* infrastructure, not as much of mine.
[...]
So in that respect, I think that security and privacy wise I'm no worse off than if they'd placed their infrastructure on their own premises.
I think your analysis is correct.
But well, feel free to comment. The compulsory router issue is new for me, and I'm unsure about the issues.
The compulsory router is a serious issue, but I agree it doesn't apply to your use case. As you say, there must be a line between the service provider and the service customer. In your case, the line is at the near end of the "router" (i.e., the router is theirs). And you can connect what you want to the outlets, so so have your own wireless, your own telephone set and your own tv set. That's right.
I think satellite tv is similar: the decoder is theirs.
The issue blessed "compulsory routers" is different: with a normal DSL line the situation is similar to old telephone or power lines: the company offers a cable that carries data or power and you use those resources as you want. Owned phone recording tools, own ups, own microwave oven and cordless device, etc. Sure the phone number and power limits are agreed by contract and are limited, but the limit is on the far end of the cable. The line between theirs and mine is at the local end of the cable, before the equipment (for power, after the circuit safety breaker, to prevent disruption of the far end).
A DSL line is the same: the PPPoE being provided is a general-purpose service, that can be exploited in several ways, without disrupting the far end. Just like I wouldn't accept a mandatory phone set on my desk or a mandatory microwave oven, I don't accept a compulsory router.
Sure I can accept a "complimentary" microwave oven from the power company or a complimentary pbx from the phone company, and even the option to rent each of them, as long as I control those devices. Thus, providers that offer a router for an extra cost or give you the router included in the base contract are fine for me, as long as the thing is under my control.
I refuse a phone that lowers voice volume when connecting to certain regions or an oven that denies cooking unhealthy meals. Similarly, I refuse to be unable to control the data sent to and from their equipment (the remote one).
It's mainly a matter of net neutrality, which turns out being a matter of freedom. But a freedom that's easy to circumvent, by contractual offers: people accept a black box in their cars to pay less insurance costs, they would accept mandatory healthy-only ovens or night-only lamps if that would decrease the cost of a kWh, they accept mandatory routers if the cost of the dsl line is less.
The problem with routers is worse, because the difference between Carsten's very-high-tech and not-yet-standard device and my very-standard DSL signalling to a conventional owned router[1] is tiny to most people. Technology is more and more depicted as black magic, a picture well received by non-technical people. So I expect soon to be unable to ssh out of a friends ethernet because of a limited device -- but the limit may well be on the far side of the cable, and it would make no difference.
So yes, compulsory routers are an issue, but mainly an issue of net neutrality. And such neutrality is a concern for so little a fraction of the user base, that it is going to be a very difficult battle.
/alessandro, too verbose as usual
[1] I told an half lie: my router is actually theirs because it include telephone services, but I chose a company that gives me full access to the local device. So am I affected by the compulsory router illness or not?