Thanks. I believe you’re right a totally fake copy couldn’t verify. So that idea was wrong.

(The MITM supply chain attack which has happened succeeds because it preserves the original secure hardware but intercepts the secret data at the display interface. But a low-effort mimic of the entire device like I suggested? That wouldn’t work).

Ledger provides a 'Genuine Check' mechanism to determine the authenticity of the device; however, it explicitly warns that it cannot detect added implants when the device's original Secure Element remains intact.

And as this workaround leaves the original Secure Element intact, good luck detecting the supply chain attack.