This report alludes to (but IIRC stop short) of confirming that there is only validation at the designated ports of entry scans. https://www.uspsoig.gov/sites/default/files/reports/2026-04/...

My suspicion is that these labels are entering the mailstream somehow circumventing the "first" scan.