Hi,
I'm no expert on the exact regulations, but I run fccid.io and have a pretty good idea of the process manufacturers go through.
Although forgery of results would be possible, almost all testing is done by independent labs. It would be possible for the manufacturer to submit a "compliant" sample but then program the rest of the units to radiate differently.
What I see most commonly are devices being sold without any FCC testing. All wireless devices sold in the USA should have certification but many new startups may not know the regulation around the industry (i.e. a kickstarter smart bike lock project might not take FCC certification into account and end up selling a few thousand devices before going belly up). Testing is often thousands of dollars so for a little-known startup they may just try to ride on the fact that their Aliexpress supplied Bluetooth chip "is FCC certified" (it's not).
It's not always startups that are skirting the testing though, Bayer's Aleve Direct Therapy TENS bosts some invalid FCC IDs on the user manual. https://www.aleve.com/aleve-direct-therapy/how-it-works/
From what I've seen, there is little to no actual enforcement that goes on within this licensing space (but there is also a pretty high rate of compliance).
The FCC has an outline from 2008 where they explain more of the compliance audit process: https://transition.fcc.gov/oet/ea/presentations/files/oct08/...