On the tla715, looks like a few bargains can be had on the used market, just did a quick check...
when you say the modules are hackable, .. in what way?
The TLA7xx modules are hackable in that there are various maximum speed and sample depth options for the modules, which can be easily set to the maximum options.
For example, a TLA7N4 module has maximum state clocks rate options of 100MHz and 200MHz, and sample depth options per channel of 64K, 256K, 1M, and 4M. No point of looking for one with better options and paying more for it when the max options can simply be enabled.
On the HP / Agilent side of things, some of the analyzer module models with different sample depths are actually the same PCBs fully populated with the maximum memory with different configuration resistors which code the model. For example people here have reported that an HP / Agilent 16750 module with 4M max sample depth can be reconfigured into a 16752 module with 32M max sample depth. That requires some solder work with small surface mount resistors so it's not as simple as the Tektronix case. Some of the newer Agilent / Keysight analyzer modules such as the 16911A have software installable upgrades which as far as I know no one has figured out how to hack yet.