> they explicitly mention not being allowed to send it externally[0]; they hash it via SHA1, encode it as base64, and use that value.

If it's sending that value out, then there is no logical difference between that and just sending out the machine-id in the first place.