&gt; They may not even have a way to limit firmware to specific devices<p>They do. The new firmware may not be distributed, but it should be easy enough to make it such that if it was distributed, it wouldn&#x27;t change security at all on phones other than the target.<p>For example:<p><pre><code>    function handleWrongPassword() {
      if (deviceId = 1234) {
        return;
      }
      &#x2F;&#x2F;do the normal phone stuff, like a delay or wipe
    }
</code></pre>
Since the firmware is signed, no phone will run the firmware if you change the hard coded 1234.