I have done some hardware design work with the RPi Compute Module and two CSI cameras. There is indeed an authentication chip on the cameras you buy from the RP

I have done some hardware design work with the RPi Compute Module and two CSI cameras. There is indeed an authentication chip on the cameras you buy from the RPi foundation. From what I understand, the idea here is to limit the drivers, so that the auto-tuning software (adjusting color balance, brightness, etc) only works with the original camera, not with clones. There is nothing that prevents you from connecting other CSI cameras (there are plenty available), or writing other drivers. It's just that the auto-tuning functions of the original drivers will only be enabled for original cameras. The driver authenticates the camera(s) at startup, and if they are not the original ones, disables the auto-tuning. The Foundation says it is a way of securing a revenue stream and recovering some of the cost of R&D work that went into the drivers. I can see how that is a compromise that could be chosen. Personally, while I am not a fan of locked-down solutions, I find it hard to get as outraged at this as some other people apparently are.