Thanks. I believe you’re right a totally fake copy couldn’t verify. So that idea was wrong.

(The MITM supply chain attack which has happened succeeds because it preserves the original secure hardware but intercepts the secret data at the display interface. But a low-effort mimic of the entire device like I suggested? That wouldn’t work).