> You're saying the chips in iPads etc. are not regulation-compliant and this non-compliance can be trivially unlocked if you know the specs?

The radio modules in iPads are compliant, assuming that the software using those radio modules is compliant as well. This is why manufacturers have to enforce specific combinations of software and hardware, as not all of the functionality and regulatory constraints are implemented in the hardware itself.

If you gain access to the radio module of an iPad, you can definitely make it non-compliant, depending on the level of access the module provides. In my experience, however, radio modules generally provide enough access that a user could potentially cause regulatory issues if the relevant safeguards were removed or you do not adhere to the specification of the radio protocol you are using.

If you don't believe me look at Bluetooth SIG listings and you will note that they specify specific software versions: https://qualification.bluetooth.com/Listings/Search