It sounds to me like imaging is the solution to attackers modifying systems during shipment.

> Are you someone that needs to worry that a delivered device has been manipulated mid-shipment?

> If you try placing a simple LaunchDaemon on a Secure Boot device’s System volume, it doesn’t stop it from booting in Full Security mode. That’s not one of the things in the signature manifest.

With DEP/MDM the existing OS and files that were there doing shipment would still be there, DEP/MDM would just add additional things or change settings. With imaging you wipe out everything that was there during shipment and start fresh.