Hacker News Reader

Which applies just the same to the hypothetical option during initial device setup.

I don't think it does because of the workaround I mentioned upthread.

The victim also can't be on the phone with the scammer using that device during the setup process. We're talking about a very high-friction scenario.