It's relatively cheap and easy to use something like ARM TrustZone that has a public key hash set in the processor via blowing fuses on the die itself to ensure

It's relatively cheap and easy to use something like ARM TrustZone that has a public key hash set in the processor via blowing fuses on the die itself to ensure that that processor will only boot up with a firmware image that's signed by the manufacturer. If you wanted to get around it you would need to replace the processor with a virgin one and then get it to load your modified firmware. It's completely impractical to do something like this to evade a geofence block. It would be much easier to just add a tiny microcontroller between the GPS receiver onboard and the processor that just introduces a large offset in the NMEA messages such that it would think it's hundreds of miles away from it's true location and evade the geofence that way.