"To do some work to make it universal" = code change = thrown hash (the signature which requires the Apple key to create, and proves the software hasn't been tampered with, will be broken/no longer valid)

Cryptographic hashes like SHA and AES are designed for "dispersion" meaning, in the idea case, flipping only one bit of the input leads to a 50% probability of every single bit in the hash flipping. So while it's theoretically possible to make a change to the code, and find a way to insert that change that both (1) does the same thing and (2) hashes the same way as the original build, it's probably beyond the realm of what even a motivated attacker could do today.

The warrant allows that the phone could be entirely in Apple's possession with the FBI having only programmatic access to the PIN input. Imagine, say, an isolated SSH server with serial access to a PIN input API.

Interesting question. I don't know the answer but would be interested to hear anyone with more information weigh in.