Sounds plausible. Another curious thing in the video demo is the alert dialog popup box that is triggered during the fake purchase, the one with the "Like" but

Sounds plausible. Another curious thing in the video demo is the alert dialog popup box that is triggered during the fake purchase, the one with the "Like" button and "Cancel" in Russian. Perhaps the storekit receipt transmission protocol allows for injecting actions on the device such as opening alert boxes, in addition to just posting a signed JSON receipt?