What will that accomplish though? The way he described their auth APIs, you will be able to set an auth token generated by you for an account that you anyway have the user credentials for.
What is a bad “UUID”? A wouldn’t the hacked client do things anyway like uploading UID or local credentials to its servers?