Couldn't an unscrupulous repair shop just install an event logger in the screen to get the password and skip this whole touchid business? Or even give you back

Couldn't an unscrupulous repair shop just install an event logger in the screen to get the password and skip this whole touchid business? Or even give you back a different phone that just looks like yours and requests your password? Fundamentally, I feel the real question is who gets to decide who I trust. I want to choose for myself.