I'm not convinced the mere fact that AliExpress sellers are not Sensirion distributors is sufficient to assume these sensors are counterfeit. Obviously there's precedence - buy a 'stm32' and you'll likely receive a counterfeit chip, but that's because these chips have been cloned by many. The Sensirion SCD40 is fairly niche and has an odd form factor - doesn't seem trivial to produce a convincing clone.
AliExpress sellers sell these at €14,99/1 whereas DigiKey is at €16,38/600 (excl. VAT). Price seems 'right' to me.
I have been looking for a comparison between sensors sourced from AliExpress and a reputable distributor, but sadly couldn't find any.
Anyway, I did get a few of these sensors off AliExpress for my personal projects. They definitely measure CO₂ (not eCO₂) - the only issues I've been having with them is the default calibration being off and a struggle to get the temperature reporting right (the sensor suffers from self-heating).