They may have been throttled/deprioritized but often the plane just has a really high latency connection. Some in-flight internet is provided via geo-stationary satellites, which has a minimum of 250ms latency. Even when a low-earth orbit satellite is used, I expect they are being back-hauled to the WiFi vendors datacenter before going out to the internet.
When your latency gets in the hundreds of ms, no amount of bandwidth is going to make your internet connection feel snappy. And buffer bloat means even a workload that could theoretically saturate a high latency connection may actually get trashed.
What not just spoof the MAC address of “machine” that has paid.
I had written a utility that monitors MAC address on the network and tries them each until it finds on that is allowed.
Looks like someone released an app to do just that.
https://github.com/t-mullen/wififox