This is in large part due to the attacker having physical access of the asset. This complicates the security. Something like, how do you ensure the user is not

This is in large part due to the attacker having physical access of the asset. This complicates the security. Something like, how do you ensure the user is not running a modded app to send requests to the backend?