I would assume the 200K lines of software and the firmware is presumably flashed after receiving the product from the assembly house.

The anti counterfeit strategy is that the volumes here aren't worth it for someone to clone, even if the board and code are dead simple.

These niche hobby products are usually reasonably safe because they rely on community network effects, becoming the darling of a random subreddit or discord group and people aren't going to save $20 to get some device of dubious origin.