That isn't really easy. 99% of the phone can be tampered with when running, after the signature is checked at install. They'd need to put that check in the sec

That isn't really easy. 99% of the phone can be tampered with when running, after the signature is checked at install. They'd need to put that check in the secure enclave to make sure that it wasn't simply bypassed. That might not even be possible on that model.