The device is built and tested according to some well-defined specifics; it is not connected to the network, and it is not capable of recording more than 3 positions and send them if an accident occurs, as well as establishing a phone call. Anything else is a violation perpetrated the manufacturer, as well as faking the specific tests that are formulated to check if the device is compliant: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32...
Abuses can always happen, and we should put reasonable checks in place to avoid them. Is the current regulation good enough to minimize the risk of having them? I hope so.