> Shouldn’t these machines simply be able to get a new image written to them and be good to go?

If they can be trivially reimaged, that’s already a security problem.

They can go through the entire recertification process with any necessary rebuilding, but the cost of that when you have no certainty what might have been done is unlikely to be less than, and may be much more than (ad hoc diagnosis being much more expensive than production-line manufacturing) just buying a new certified machine.