They can even still use the mechanism for theft-deterrence by checking whether the original phone is iCloud-locked before allowing you to associate the part with the target device.
Each piece will probably come with a unique QR-encoded serial code that will require activation online before it can be paired with the phone. Not really a rocket science.
Via iFixIt:
> You’ll be able to buy parts and tools through the ‘Self Service Repair Online Store,’ where you’ll also have access to service manuals and some version of their repair-enabling software.
https://www.ifixit.com/News/55370/apple-diy-repair-program-p...
This is never going to happen as long as touchid/faceid exist.
There's a security guide that talks more about what the threat model is and where exactly the encryption and trusted communications happen. https://support.apple.com/guide/security/touch-id-and-face-i...
If you believe that you are the target of such a threat actor, you probably aren't keeping much on your phone. I would assume that if you are under that kind of threat, you don't keep secrets on a device that isn't airgapped.