Comcast has a prepaid "Xfinity NOW" service that's cheaper than normal Xfinity, with unlimited data instead of a 1.2TB/month cap. If you currently have Xfinity, the NOW online signup is hidden, but when I called to cancel my Xfinity service on a date a couple weeks in the future, the NOW signup started working immediately. (I initially queried a neighbor's address to confirm that NOW was available in my area.)
The catch is that you can't use your own modem. They provide a free Arris TG1682P (also known as the XB3), but it's huge and uses more power (14.9 watts) than my Arris SB8200 (9.8 watts). I suspect they retired millions of these things and treat NOW as a recycling service.
The XB3 lets you enable bridge mode via the admin page at http://10.0.0.1/, and IPv4/IPv6 works just like a plain modem, but even in bridge mode, the gateway broadcasts several hidden SSIDs with no option to disable the radios. Curiously I did not see an xfinitywifi broadcast, but your modem may vary.
I found reversible hardware mod to disable the WiFi radios.
Refer to this disassembly video. There are 6 screws (2 hidden), lots of plastic prying, and you will probably wrinkle the rear sticker.
My circuit board is labeled TG1682/TG2472:
Notice the two shielded WiFi modules. The shields just pop off but you can leave them on. In between is an 8-pin chip labeled "54328", a TPS54328 buck regulator. The output pins connect to various pins on both Atheros WiFi chips. Pin 1 is EN/enable. It measures 3.3 volts, and when I connect it directly to ground, it sinks negligible current.
So that's the mod. Connect Pin 1 on the 54328 to anything grounded. I used the far side of this nearby capacitor:
The XB3's idle power consumption dropped from 14.9 watts to 12.5 watts, the WiFi lights are off, and everything else seems to work via wired ethernet. I notice that http://10.0.0.1/ is inaccessible (connection refused or HTTP 503) for a few minutes after booting, but it wakes up eventually.
I don't actually know what circuit pulls up the EN pin, so it's possible that I'm overloading a digital output somewhere. I just measured amps to ground and saw a small number. My first idea was to desolder/lift the pin, but I found that too difficult.
The XB3 uses an Intel Puma 6 chipset, which has been in the news over the years due to latency/jitter problems. So far I'm not seeing anything weird on https://gfblip.appspot.com/ or https://speed.cloudflare.com/.