However, my understanding is that this could be exploited only by authenticated users with permission to add new media. Not like that's a risk to ignore, but it's not like it could be exploited by anyone on the Internet.

I wonder if that's the reason for setting the default live TV management permission to false. Since that permission might well the the route to adding your own malicious m3u link for that second change.