AFAIK "end-to-end encryption encoded at firmware level" is the current official answer: https://www.reddit.com/r/Starlink/comments/8049u6/starlink_t...
> If it is (and we learn about it), a crypto fix will go out immediately via network-wide firmware update.
This implies that the SpaceX holds private keys for signing firmware updates, and a mechanism for pushing them.
I hope those keys are kept very far from anything Internet-connected.
If you have cable internet, try going to 192.168.100.1. [2]
[1] https://en.wikipedia.org/wiki/DOCSIS
[2] https://www.computerworld.com/article/2880475/talk-to-your-m....
The other person said that they can push firmware to private modems though, which is not possible without that modem being configured to accept such pushes.
Perhaps you're thinking of CWMP (TR-069) which is a protocol that ISPs often use to push configs to modems configured to receive them, but again, it cannot be used to arbitrarily flash the firmware of private modems.
https://motorolamentor.zendesk.com/hc/en-us/articles/2160917....