How does one “simply replace the firmware” is a way that isn’t trivial to spot by an observer?

Assuming there is no external IO such as USB or Ethernet, someone would have to disassemble the machine and solder a programming header in order to re-flash the device.