Presumably Valve could record all the serial numbers at the factory and simply block steam logins from accounts don't own a steam machine for the first year or so. The hardware wouldn't be locked, it'd just be steam that refuses to allow logins from the wrong account, steam already sends over your hardware id during the login process so they definitely could use it.

And yes, it's not hard to spoof your hardware id, but who is going to buy a machine at scalper prices only to then need to run sketchy software to even be able to use it. It'd completely kill the scalping market and not affect anyone buying one to use.

Exactly. If you're selling stolen or pirate product at a cut rate, people will tolerate goofiness for the better deal, but if you're scalping and people are paying above-market, they're not going to take the risk on sketchy purchases that may get their Steam account banned or something. And the scalper isn't going to take the risk buying a ton of product they can't unload, so even Valve stating they will enforce this would have a measurable effect.

Imagine buying the SM for a teenager in your family that doesn't have a Steam Account yet.