> … the less likely it seems that it would make it radically easier for those bad actors to do so

Depends on implementation. I can easily see a possibility that the check is gated by a server side logic that can be changed at any moment without anybody knowing.