I think what's giving me more concern is: what if the Pi is embedded in a device and the manufacturer doesn't realize the supply chain got tampered with?

https://github.com/raspberrypi/rpi-eeprom/issues/761

One EEPROM update and suddenly you brick the board. It's like the FTDI bullshit. You're going to end up snaring legitimate users that didn't know they had illegitimate boards.