Cable modems aren't like your home router (ie. they don't have a web interface with simple point-and-click buttons that any kid can "hack" into).
Cable modems are "looked up" and located by their MAC address by the ISP, and are typically accessed by technicians using proprietary software that only they have access to, that only runs on their servers, and therefore can't really be stolen.
Cable modems also authenticate and cross-check settings with the ISPs servers. The server has to tell the modem whether it's settings (and location on the cable network) are valid, and simply sets it to what the ISP has it set it for (bandwidth, DHCP allocations, etc). For instance, when you tell your ISP "I would like a static IP, please.", they allocate one to the modem through their servers, and the modem allows you to use that IP. Same with bandwidth changes, for instance.
To do what you are suggesting, you would likely have to break into the servers at the ISP and change what it has set up for your modem.
Could they simply be using static arps? ACLs? Other simple mechanisms?
Every ISP is different, both in practice and how close they are with the larger network that is providing service to them. Depending on those factors, they could be using a combination of ACL and static ARP. It also depends on the technology in the cable network itself. The ISP I worked for used some form of ACL, but that knowledge was a little beyond my paygrade. I only got to work with the technician's interface and do routine maintenance and service changes.
What keeps me from changing this IP address to, let's say, 220.127.116.11 and mess with another consumer's internet access?
Given the above, what keeps you from changing your IP to one that your ISP hasn't specifically given to you is a server that is instructing your modem what it can and can't do. Even if you somehow broke into the modem, if 18.104.22.168 is already allocated to another customer, then the server will simply tell your modem that it can't have it.