This works as long as each of these boxes connects directly to the streaming provider's servers. With pirate streams often there's a pirate streaming provider with a legitimate subscription, whose STB handles the rekeying, then the already-decoded AV stream is captured and redistributed. The end-users never actually stream from the streaming company, they stream from the pirate. That's often how sports are pirated, and your best bet is going to everyone's homes and checking that they're not watching your streams without a license.
Right? Each legitimate stream, including the pirate's, includes a unique ID. The content protection company subscribes to the pirate stream, gets the ID, and shuts down the pirate. This works today.
The problem that Sky has is that most premium sports content is available in other countries with less effective copy protection, so that's where the pirate streams originate, and Sky can't do anything about them.
You're right that none of this affects the end-users.
Sure, you can buy a box and inspect that stream, but if there's a multitude of pirate streams it's an eternal whack-a-mole game. You cancel one pirate's subscription, the streams redirect to another, in the meantime the first pirate somehow gets access to another legitimate stream and so on.
This also doesn't account for the fact that there might be another proxy pirate in the middle who would relay the stream without the ID to the box (this and the first pirate might as well be the same person). This way even if you have the box you cannot find out which subscriber specifically the stream originates from, as the ID is gone before the stream is sent to the box.
To be 100% sure nothing is pirated, the streaming provider would have to either MITM the traffic from the ISP to the end-user (not legally possible) or just plain old show up at a place of a non-subscriber and inspect the equipment (again legally questionable).
