Or even if the device is authentic, every bit of data has to be assiduously validated because there’s known evidence of modifications after it left the repair shop. DKIM signatures did that for some emails but a lot of stuff has no obvious path to validate like that and now the repair shop guy is expressing concern, too:
https://www.washingtonpost.com/politics/2022/04/12/now-warni...
When the Washington Post finally looked at it, it was pretty tainted, and about the only conclusion you can draw is that there are some authentic emails on it, but that doesn't make the device authentic.