Each cable modem knew which devices were attached to them (IP and MAC). A dumb ISP would limit you to one MAC on the CM, even though it made no difference to them. Perhaps trying to upsell more connections. Everyone just got routers instead. The CM receives packets from the CMTS for everyone on your 20 mile stretch of cable. It needs to decode them to know who they're for, where one ends and where a new packet starts. An option, configured by the ISP and downloaded as you connect to the network, would tell your modem to either discard all traffic that didn't belong to a known device on your local subnet, or just spew absolutely everything out on your local ethernet. Many ISPs configured their modems to spew everything. Not only was this insecure, most PCs didn't handle all the ethernet interrupts gracefully either, and it could grind your PC to a halt.
CMs also supported encryption, optionally, at the discretion of the ISP (the "Baseline Privacy" you see in the article). Hardware assisted encryption was just rolling out, and only on some CMs, so many ISPs would have this off to improve throughput. DES or 3DES, and possibly another option was available at the time. Your CM and the CMTS would negotiate keys, rotate them with fresh ones every now and then (configurable duration). With this in place, your modem wouldn't be able to decode your 20 miles of neighbours traffic. Your data was secure, at least to the cable office, which could act as nefarious as they chose (why end to end encryption is ideal).
Traffic on another channel would never be decoded (unless the CMTS told your CM to switch channels, it could actively migrate you to optimize the network, shunt you off a channel whose hardware was about to be replaced, then move you back all seamlessly... there would be slight hiccup while it re-did ranging, etc).
Source: I used to write CM firmware for Docsis 2.0 modems in the late 90s.
