There is no way to know that. Someone could remove the entire computer, put it on a shelf, operate the car with a modified one and put the original back in before they sell it to you.

Moreover, this rule is about remote access, not what someone can do who has direct physical access.

Yup. In fact, I have a vehicle where exactly that happened. Bought a used diesel pickup truck. A year later it wouldn't start: ECU was completely unresponsive and wouldn't even send anything over OBD. Had it towed to the dealership and during their analysis they found an aftermarket torque chip in the ECU and removed it. Truck started right up after that.

If the dealer hadn't mentioned that, I'd never have known. I don't even know if the person we bought it from knew about it since he was the second owner.