By the time the device gets to QA[1] the money has already been paid to the counterfeiter, and it's going to be hard to get that money back.
Someone will lose money, but it's not going to be the counterfeiter.
Yeah, pretty much. SparkFun got an entire shipment of fake Atmega328s like this a few years bacK: https://www.sparkfun.com/news/395
Yes, and they were actually controller circuits for CPU voltage regulators.
There is also a market for recycled and semi-properly labeled chips, for example selling low precision grade analog chips as a higher grade or chips tested for the usual 0-70°C operating temperature range as rated for military/aerospace range -55-125°C.
This is harder to catch with QA. A few years ago there was an investigation in the US where they found some examples of such chips in military equipment and also proved counterfeiting beyond any doubt by ordering military grade parts which have never been offered by the manufacturer in military grade - the vendor simply relabeled them.
As another commenter said, smells like an urban legend.