How do I block anyone from making account changes or subscribing to other packages?

Parental controls don't keep any user from upgrading the subscription. This can get expensive and there needs to be a way to stop that with some security. 

If you don't provide other users with the login credentials but just leave the streaming devices logged in, there shouldn't be an issue - unless things have changed, you can't change the subscription from the device, only from the website.  However, now that they've added PPV (at least on Ospreys), there is an issue with that and a PIN or some other control to limit buying/renting PPV would certainly make sense.

My aunt has twice subscribed to add-on packages accidentally through the osprey box, once to NBA League Pass (no one in our house watches NBA) and once to HBO (already subscribed to it separately). I'm the only one who knows the password.

There are no parental controls on the Osprey box for purchases. You don't need a password to sub thru the box.

This is obviously a pretty substantial omission on DTV’s part - they should never have added PPV or subscription changes through the device (which caches logins) without providing a mechanism to lock them out. But they did.  I’d consider this incompetence on the part of the DTV product marketers (or whoever it is that defines the product changes).  But there’s no way to know whether they are aware that customers view this as a (major) problem or if they care.  Nor do I know a way to make sure the powers-that-be (even higher in the food chain) are aware.  I don’t believe that the DIRECTVhelp reps can do that (regardless of what they claim).  So maybe make noise on their Facebook account?

Similar problem here unfortunately. Family members that are elderly and have dementia making accidental purchase. Have two DirectTV streaming boxes for a couple months now and it’s only happened once so far and DirectTV did refund the charge upon taking the time to call customer service. 

Imo this is an intentional omission by DirectTV and they are being negligent to their customers to see whom are paying attention to and scrutinizing their finances for unauthorized and unintended purchases. If they can easily implement Parental Controls with passcode, they can do the same for unauthorized/accidental/unwanted ANY and ALL purchases.

It’s a hassle to have to call customer service and explain the problem to get refunded despite other customers indicating that they do refund each time for unwatched content. But what about the accidental purchase of a channel or something that isn’t immediately noticed by the customer?—because, you know, we all have busy lives and don’t need another thing to have to include on the already never ending to-do lists!

@DirectTV —Please implement account purchase protections immediately into ALL of your cable services systems!!! Every other provider I have or have had offers this simple option to be enabled, or not, within the Settings Menu, via a PIN code.

Don’t ascribe to malice what is adequately explained by incompetence - a slight rephrasing of Hanson’s Razor. 

I seriously doubt that they didn’t provide a lockout in order to trick customers and gain a little extra revenue.  I believe they didn’t provide it (yet) because they aren’t really good at figuring out what customers want/need and they probably don’t have enough development resources to do everything they need to do in the right order and in a timely way.  Hopefully it is becoming apparent to them that this is a problem they need to fix, and soon.