> They’re using an MCU (ST MCU with Cortex M4 core) that doesn’t have any meaningful security features (ie, no secure boot, no differentiation between trusted and user mode operation - features the newer Cortex M33 core supports and newer ST parts implement).
This doesn't help any bit against the hardware implant we're discussing here.
> So there’s no way to guarantee that the software running on this has not been tampered with.
While true, I don't think it matters too much, other than the possibility of turning the device into something like a rubberducky.
> There is no physical tamper detection either. No tamper pads to detect case openings, no seal that gets broken when it’s opened that prevents operation. As others have mentioned, the most basic precaution would be to glue the whole thing together, which they didn’t do either.
Now that is the real meat. Unfortunately, for any given attack it's possible to bypass it. Tamper pads, if you know where they are, you can drill through the housing and, depending what it is, keep the button pressed by a jig, or solder wires if it's a sense trace to bridge it. The housing itself can easily be fully replicated, it's just a matter of coughing up some money for custom molds.
The only way to make something relatively tamper proof is to use injection molding over the full housing with something like glitter as part of the plastic, that will distribute randomly - and most importantly: not replicable! - across the housing, and then take high quality photographs and store them on your website together with the serial number.
That way the customer can photograph the device they have, and compare the random glitter specks with those on the website.
Tamper proofing hardware is among the hardest things there are, especially if you are up against nation-state actors like North Korea (that has been known to engage in cryptocurrency theft in the past).