> and won't help you if your thief-in-question chucks your iPhone into a Faraday bag
No, it does (and works well!) because the parts don't need to know that they're stolen. That's not how lost mode works†; the parts themselves aren't refusing to cooperate with the new phone. Rather, it's the other phone that needs to know that your phone's parts have been stolen. It then refuses to cooperate with the parts, after the parts identify themselves. All the parts need, for this to work, is immutable individualized bus-message signing keys (a.k.a. "serialized parts.")
Remember that we're also assuming here, a phone ecosystem that has a Trusted Computing Base — one where you fundamentally can't get root to modify the phone's firmware from the signed one that the manufacturer puts on there. (Or at least, not in a way that would leave the phone in a condition that a person just submitting a phone to a repair shop would find acceptable. Jailbroken iPhones, when possible, can no longer follow upstream updates, for just one problem. That's not the kind of thing that would be considered a "successful repair" — it's the kind of thing that'd have the phone taken back for a refund on that repair.)
The presence of a Trusted Computing Base on whatever "compute core" the other parts are going to be attached onto, means that you can't get in the way of any Certificate Revocation List that he manufacturer issues for the signing keys that these retroactively-marked-as-lost parts will present to the new phone when they attempt to pair with it upon activation.
---
† "Lost mode" actually triggers three separate things:
1. it sends out a notification to the "compute core" of the lost phone that either immediately — or the next time it comes online, if it hasn't since been rooted [which as I said, is unlikely, for customer-UX reasons] — will lock itself up until someone in possession of it goes through a KYC-like identity verification process with Apple to prove that they are the legitimate owner of the phone — at which point Apple issues a signed packet that tells the "compute core" to un-clench. As long as the "compute core" is locked, it's useless to "chop shops", and just gets discarded as waste in the scrap process.
2. it looks up the certificates used by the various "serialized components" of the phone to sign their bus message traffic (which Apple knows without having to ping the phone, because it recorded those cert IDs when generating them, before burning them into the parts; and knows which phone they went into on the assembly line, because serialized parts) and puts them on an activation-time Certificate Revocation List that all other iOS "compute cores" fetch. (This is what "activation" — in the era of factory-unlocked phones — is: fetching the most up-to-date Certificate Revocation List, and checking whether the signing keys of any of the phone's parts are on it.)
3. it places the "compute core's" associated IMEI number, if any, onto IMEI blocklists; and places the "compute core's" MAC addresses onto government watch-lists. Why bother? Well, sometimes there's no "customer"; instead, some smaller number of these phones are stolen by professional gangs that own the whole pipeline, and their goal isn't parts for repair, but rather to get entire working (nice, modern) smartphones into the hands of "important" people, in countries that Apple's enclosing jurisdiction has decided should not be allowed to "import technology" from them. These groups do this by 1. Faraday-caging the phones, 2. importing them into their country, and 3. delivering them to a jailbreaker who works in a Faraday-caged room. IMEI blocking means that if you successfully did this, your phone might end up working fine on your corrupt country's networks — but the moment you bring it to another country, the baseband modem (which even rooting the phone can't really interfere with) will receive the updated IMEI blocklist from a local network provider, and lock itself up. And then, ideally, the user will try to get online anyway by connecting the phone to some major public wi-fi like an airport — at which point the state actors who monitor MAC address logs of these major public wi-fi APs, will know that there's a Person of Interest in the country.