My understanding is that it uses bandwidth you aren't paying for to carry this signal rather than using up what you paid for, but still it's been there for something going on ten years.
Not your creds. Nothing stops the manufacturer from making a deal to get an account from XFinity and shipping the creds on the TV. Then they can exfiltrate data from anyone who has an Xfinity repeater anywhere in broadcast range.
Some parts of these organizations are aware that some of their rent comes from inertia. Other parts don't realize that they are providing the impulse to overcome that inertia.