A cursory X-Ray would show the internal SD. This product needs a hardware re-design (which I've seen other projects do) to have onboard flash instead.

Saying that, any proper investigation would read the firmware from the flash and identify the decryption routing anyway