A bad cyber actor could change channels, mess with the volume — or even watch you, the agency warned.