Shady developers would try very hard to get past such checks, for example by changing that message based on the date, IP address range, nearby WiFi networks, receipt of a payload, etc.

They could introduce an optional string-valued entitlement and check its text. That would be a lot easier but still require them to translate messages.