If you need to physically get into a device with CM4 or rPi to reset it.... ...and you are malicious actor wanting to put a backdoored system in ...you could

If you need to physically get into a device with CM4 or rPi to reset it.... ...and you are malicious actor wanting to put a backdoored system in ...you could just get the new rPi in it, that's not blocked.