What about authentication details held in the "secure enclave", or equivalent? If they can unlock my phone, I think it would be faster and easier to just install their "extra software", rather than the technical difficulties involved in transparently replacing the hardware with a new copy of the same thing.

Especially if I've got a semi-obscure phone in an unpopular color. That's at the level of a targeted attack against an individual.