The hotspot feature works, they just don't relay traffic that did not originate on the phone. Its a simple packet filter rule on their side to block it.
Nope, not a limit on TCP connections, VPN will also not help as the hotspot bypasses any VPN on your device unless rooted.
Well, it's not easy to distinguish what was natted from a device behind the phone, and so it depends on your phone and OS. VPN doesn't necessarily get bypassed.
But it does seem like the simple TTL trick will do. Neat easy trick, but also easily circumventable. But not for the average user I suppose.
So a combination of IMEI identification (only allow phones), a SIM profile that doesn't allow hotspot/tethering, and inspecting of the TTL will generally do the trick it seems.
Yes, it will definately stop the average user.