Your device tends to need to be causing problems, that the FCC then go and track down, and then come back to you. That is (hopefully, depending on the kind of device) extremely unlikely.
As for Ali stuff, probably lots of it is not tested but still comes with a FCC label - but if it is shipped from overseas, who is going to take responsibility for it? Nobody… So there is nothing they can do except fine the person who bought it if it’s really causing problems (and usually I doubt they’d even do that if the user wasn’t intentionally doing something they shouldn’t have been, they are just told to stop and maybe the device would be seized/ destroyed)
Yes, though they can also ask for your lab results or to inspect your testing facility and hit you with massive fines if it turns out you falsified your compliance documents. As you mentioned this is very rare though - even enforcement actions against non-certified intentional radiators are uncommon.
I recall trying to build some hardware in 2020 and getting discouraged because of the CE/FCC silliness. Even though I could self declare for the EU it seemed like a big risk to do so.
Imagine making a mod for a video game, and to legally cover your ass, go through months of testing that cost $250,000.
Talk about killing a project in the cradle.
On the flip side, there are engineers who absolutely do not give a fuck, and will design their product with zero regard for emissions. To them the world is "If it's not illegal, then I cannot comprehend why I cannot take it to the extreme".
https://emcfastpass.com/fcc-rules-kits-subassemblies/
Putting that board into an enclosure and then selling it now makes you the manufacturer, and you must certify that new product.