The device can identify itself with a UUID, which isn't key material and doesn't allow anyone to break the channel between the actual device and the server, whi

The device can identify itself with a UUID, which isn't key material and doesn't allow anyone to break the channel between the actual device and the server, which is still authenticated by the client using the server's public key. The attacker could generate a random UUID and connect to the server, but then it just shows up as an unconfigured device and gets ignored. The attacker would have to extract the UUID from the device it wanted to impersonate, which still wouldn't allow it to impersonate any other device the same way a WiFi password does, and would then be detectable because there would be two devices claiming to have the same UUID, at which point you generate a new one for the real device after addressing whatever allowed the attacker to extract it to begin with.