(UK) my new Virgin media cable box came with a hdmi cable that said "hdmi with ethernet" on the side. It's plugged into my TV (which has WiFi disabled) and as far as I can tell it's not leaking a gateway or anything but it could well be. Regardless: security nightmare.

The HDMI with ethernet thing is probably a lot more benign than you would think. Ethernet is simply one of the many protocols that HDMI can use for its communication across that wire, in addition to the video feed; as a result that ends up on the package. Very few television sets even support the feature in any capacity; it's generally more practical to just use wifi.

Besides that, a cable company's set top box doesn't need to use any fancy HDMI tricks to snoop on what you're watching at any given moment: the cable box does that for them. This doesn't give them any information other than the channel you have selected at any given moment (and whether the TV's actually on), but that's enough for ad tracking and viewership ratings, and that's usually all the network cares about.

(Note that I still find that whole feedback loop a bit uncomfortable; I won't ever have a cable subscription myself. But I have a hard time believing those cheap set top boxes are sophisticated enough to extract frame data from arbitrarily televisions over HEC; the compatibility issues alone would be a nightmare to code around.)

>Besides that, a cable company's set top box doesn't need to use any fancy HDMI tricks to snoop on what you're watching at any given moment: the cable box does that for them.

I believe they were worried about the reverse - the (isolated, wifi-disabled) Smart TV using ethernet-over-HDMI to phone home.