[isantop]

Compromising the PCBA is not reasonable attack, if you trust the company you're buying the hardware from. Their engineers will review the delivered hardware and ensure that the delivered design is identical to the one ordered. Realistically, the kind of bad actor this is marketed to prevent have no trouble getting into a chip fab in China (where the chips going onto the PCBA are produced) and inserting hardware backdoors there, which couldn't necessarily be detected by the engineers.