Nothing has been tampered with doesn't mean there's no factory backdoor, it just only means same as factory, nothing more.

Apple or Google know what the cryptographic signature of the boot should be. They provide the keys. It's how they know that "factory reset" does not include covert code installed by the factory. That's what we're talking about.