Are hardware IDs reliable at all - I've seen so many companies using HWIDs in their anti-cheats over the years and it has never worked; so I wonder if this would easily be worked around.

It wouldn't be hard, but who would pay scalper prices for something that they then have to run dodgy software on that may or may not jeopardize their entire steam account?

This is a different threat model than anti-cheat. Here you just want it to be annoying enough to stop scalping.

So presumably if you make an account which didn't buy a Steam Machine unable to log in on one, you kill the scalping market. It doesn't have to be perfect to make it unpalatable for scalping. Is a scalper going to take the risk on buying a ton of hardware which they can't offload at a profit without also getting users to hack the thing to get it to work and risk a Steam ban?