Analogously, there's evidence that companies will make extensive use of available techniques (browser fingerprinting, cookies, etc.) to track and surveil users without their knowledge and often against their will. The exposure of that arguably also hasn't triggered an effective backlash against those companies. So, as with the pre-Snowden evidence for domestic communication interception by the NSA, I think there's ample evidence of the willingness of companies to exploit whatever technologies they can in order to surveil users.

The way this is typically handled is through compartmentalization, where no one working has enough of a global view to be able to claim that the behaviour is problematic.

There's a lot that's problematic that we suspect that is going on but don't have firm proof, because the organization actually is pretty good at keeping it secret enough. There's some exceptions where things do get leaked/revealed, but how would you know if this was 99% of wrongdoing, or 0.99% of it?

Isn't messing with TTLs a pretty obvious thing to do when communicating covertly? And wouldn't that kind of packet inspection only catch cases of TVs literally acting as packet-level routers, but not catch application-layer shenanigans like aggregating statistics in the exit node so that all the data going over your own network appears to be originating from the same device?

It's still implausible, but thoroughly verifying that your TV isn't spying on you isn't trivial.

There's no requirement that the mesh be IP-based or function as a layer-3 router...

Even if it were IP-bsaed, it would be extremely straightforward for one box to send a UDP message to another, and receive and retransmit at the application layer. No TTL nonsense, No multiple IPs showing up communicating upstream.

But if my TV is doing this, then by definition it's not acting as an exit node so how do I test it?