[jacquesm]

> since people modify the firmware of mass-manufactured ebikes all the time

They certainly try. Some bikes are better protected than others and part of the certification process is to verify it isn't trivial to hack the bikes. And if this is found to be the case after the fact certification can be withdrawn, retroactively so manufacturers have a lot riding on getting this right.

Note that in plenty of places nobody cares, but in some countries authorities are strict (and getting ever stricter).