If you have lost physical control of your device long enough for hardware to be replaced, you should consider it compromised and untrustworthy if you are workin

If you have lost physical control of your device long enough for hardware to be replaced, you should consider it compromised and untrustworthy if you are working at that level of attack risk. And they absolutely could be done at scale. If more people were in the field and had the know how, it could absolutely be done at scale. In many of his video he remarks that it's difficult for him because he can't source parts, because Apple refuses to sell them to him. He has to go to eBay to buy parts for many devices he fixes.