Re: What security are they building in?
For additional boxes, I would imagine that when they fire up and connect, they need to register with the gateway box so that they can be establish some form of IPSec tunnel between them. Then there will probably be a proprietary handshake or two to set up the link - perhaps over the daisy chain of site, or perhaps direct, but nonetheless there will be plenty of authentication, possibly also against a list of device serial numbers that are expected to be installed.
None of the above is much different to the macro network infrastructure.
At the end of the day, GCHQ heavies can still lean on the operator to give them access - whether via a Legal Intercept gateway, or one of those mysterious black boxes that do pukka DPI