AFAIK net neutrality doesn't make it illegal to tamper with traffic (only to apply discriminatory QoS/throttling), and only applies at the telco/ISP level.

Internal routers rely heavily on traffic blocking and manipulation. Many corporate networks inject their own HTTPS certificates so that they can still analyze/detect/block HTTPS traffic, for example. Most public wifi access points in the US will hijack traffic until the user agrees to a Terms of Use or something ("captive portal").