Where I live, you can replace an ONT easily. GPON in my small country is only secured with the ONT serial number and a static well known password.
From a security perspective, that's perfectly fine. No one is going to hack their own neighbours or dig out fibre cables. From a usability and freedom of hardware choice, that's even better -- SN is written on the ONT and can be easily input into another ONT, unlike passwords and encryption keys that are largely unnecessary and only complicate things, providing little security because no one will hack GPON infrastructure.
You run into problems, however, if you are subscribed to telephony. It's possible that the ONT will handle VoIP for you and provide you just with a RJ11 jack. In that case, you can't easily swap your ONT. But for IPTV and Internet, it works out of the box.