that it needs a trusted measurement of the current time.

That's easily generated by doing it internally. Sure, you can't easily have a precise, trusted measurement that doesn't suffer from drift - but in this case it doesn't practically matter.

So you test ~7days runtime or external clock says you've gone > 7days. Lock on either condition. You can mess with the latter as you say, but not the former. Well I suppose you can de-power the device but that doesn't really help you either. Am I missing something?