They could very well enforce login for the entire app, that doesn’t require any closed source code and everyone would be worse off.
Given this was "a developer using upstream code verbatim", in your analogy "ricardobeat" would've been printed on the blank postcard by you, then you gave me the postcard with permission to use/modify/redistribute it. Plus it'd be a machine-readable field interpreted as "this postcard supports the same envelopes as ricardobeat's template", not something read by a third-party.
(Later, a trick was found to replace the signature and still boot, but it required extra chips in the game cartridge)
- "It is more convenient" is not a strong enough argument there, that's kind of the point of a commercial venture.
- Yes, they could be nicer about it. They aren't. That doesn't make this any more legal or acceptable.