Comcast has a prepaid "Xfinity NOW" service that's cheaper than normal Xfinity, with unlimited data instead of a 1.2TB/month cap. If you currently have Xfinity, the NOW online signup is hidden, but when I called to cancel my Xfinity service on a date a couple weeks in the future, the NOW signup started working immediately. (I initially queried a neighbor's address to confirm that NOW was available in my area.)
The catch is that you can't use your own modem. They provide a free Arris TG1682P (also known as the XB3), but it's huge and uses more power (14.9 watts) than my Arris SB8200 (9.8 watts). I suspect they retired millions of these things and treat NOW as a recycling service.
The XB3 lets you enable bridge mode via the admin page at http://10.0.0.1/, and IPv4/IPv6 works just like a plain modem, but even in bridge mode, the gateway broadcasts several hidden SSIDs with no option to disable the radios. Curiously I did not see an xfinitywifi broadcast, but your modem may vary.
I found reversible hardware mod to disable the WiFi radios.
Refer to this disassembly video. There are 6 screws (2 hidden), lots of plastic prying, and you will probably wrinkle the rear sticker.
My circuit board is labeled TG1682/TG2472:
Notice the two shielded WiFi modules. The shields just pop off but you can leave them on. In between is an 8-pin chip labeled "54328", a TPS54328 buck regulator. My meter shows that pins 6-7 (Vout) connect to various pins on both Atheros WiFi chips. Pin 1 is EN/enable. It measures 3.3 volts, and when I connect it directly to ground, it sinks negligible current.
So that's the mod. Connect Pin 1 on the 54328 to anything grounded. I used the far side of this nearby capacitor:
The XB3's idle power consumption dropped from 14.9 watts to 12.5 watts, the WiFi lights are off, and everything else seems to work via wired ethernet. I notice that http://10.0.0.1/ is inaccessible (connection refused or HTTP 503) for a few minutes after booting, but it wakes up eventually.
I don't actually know what circuit pulls up the EN pin, so it's possible that I'm overloading a digital output somewhere. I just measured amps to ground and saw a small number. My first idea was to lift the pin before soldering the wire, but I found that too difficult.
The XB3 uses an Intel Puma 6 chipset, which has been in the news over the years due to latency/jitter problems. So far I'm not seeing anything weird on https://gfblip.appspot.com/ or https://speed.cloudflare.com/.
I'll contribute my findings as well. My version is also the TG1682_CD. Here is an overview showing the front of the PCB (with the LED lights) and the location of the buck regulator. I have labeled pins 1 (enable) and 8 (voltage in).
Here is a closeup of the area.
My first attempt was to use a soldering iron to melt the solder at pin 1 (EN) and use a razor blade to lift the chip's leg off of the solder pad. Leaving pin 1 as floating did not disable the wifi and, once booted up, was broadcasting on those hidden SSIDs as before. Then I realized I meant to disconnect pin 8 (VIN) to remove power to the regulator altogether. After lifting the leg on pin 8, the cable modem boots and runs normally, but without any blinking wifi lights or hidden wifi channels. Here is a picture of the aftermath.
I have no tools to measure power consumption, so I do not know how many watts this saves. But now those xfinity wifi signals no longer interfere with my own wifi router, so I'm happy.