> when attackers capture real devices, extract cryptographic keys or identifiers, and use them to build duplicates

If they've captured the device, what if they don't clone it but use it directly instead?

It is often the case that a device is stand-alone, doing its thing without input from a user. E.g. data collection or independent/remote process control.