...So someone replaces it with known random stream. Or, say, a known PRNG.

The malicious device could simply respond with a bunch of random bits which were recorded earlier.

This isn't my field, but I'm not sure if they should check for 3% or 0.3%.