As far as I'm aware, they are only required to allow you to use your own router.

No. At least in The Netherlands the regulations are very clear. Any device that directly or indirectly connected to fiber, copper, or 'electromagnetic waves':

https://wetten.overheid.nl/BWBR0038908/2016-12-28/#Artikel1

Also, if you read the rest of the regulation, they make it very clear that the ISP should accommodate the user making it possible to use a passive end from the ISP (so, just the fiber/copper, with no active devices from the ISP required):

https://wetten.overheid.nl/BWBR0045477/2022-01-27

ONTs these days do much more than just media conversion - SIP, PPPoE, IGMP

The ONT (at least in the definition used in our country) only does media conversion. Usually a dedicated device is used as the ONT (Genexis/Nokia ONT) that just does the fiber <-> ethernet media conversion. You can use the ISP's or bring your own. Some people use an SFP+ module as the ONT.

PPPoE, SIP, etc. are usually handled by a combined router/modem.

For all of those modems/ONTs, the firmware updates and the configuration for telephony/SIP and PPPoE are controlled by the ISP and also tested to work with their OLT or CMTS so it's just not possible for the ISP to guarantee support for any random modem or ONT.

It is not a problem in practice. E.g. my provider allows you to bring your modem/router, as long as it supports PPPoE and VLANs. For example, I currently use the provider's media converter and use a Unifi Gateway Max as my modem/router (it does PPPoE). Before that I had fiber directly hooked up to my own Fritz!Box with an SFP+ module. I'm on some Dutch tech forums and people use a lot of different equipment:

- ONT: provider or their own media converter, or an SFP+ module (typically Zaram or AVM).

- Router/modem: Unifi (e.g. Cloud Gateway with fiber <-> ethernet converter or a Dream Machine with an SFP+ module), OPNsense (handles PPPoE as well), Fritz!Box, a plain old Linux distribution, OpenWrt (seems more rare).

ONTs which do not do any routing whatsoever, the device on the other side still has full control over your dumb device via the DOCSIS provisioning process or GPON's OMCI

I think ONTs are less of a problem, because it's on the other side of a security boundary. The modem/gateway is where you don't want an ISP backdoor.

So, I find that it's highly unlikely that the ISP is officially required to support a user supplied modem, although I haven't consulted the EU laws on this.

It is, as long as the ONT and modem correspond to the specs. E.g. my provider requires PPPoE and VLANs [1]. As long a router/modem supports it, they have to allow it. Of course, they don't have to debug issues inside, say a Unifi gateway for you. But if such a device fulfills the requirements, they have to allow it on their network.

Again, people here do all kinds of stuff. Like recently I saw someone who uses a Banana PI R4 with a Zaram SFP+ module as their ONT+modem/router. And the ISP has to allow it, because the user is allowed to replace any active component.

When I experimented a bit with SFP+ modules, etc., I had the ISP on the phone some times and they were very helpful and accommodating and said that my setup was pretty normal compared to what they saw some other tech people doing.

[1] https://assets.ctfassets.net/zuadwp3l2xby/2Yp0HtLJPKBUX5mqr3...