I think that's the wall in Apple's walled garden here. From reading the official Apple spec. for partners a while back, as part of the pairing process, something is signed by the device with a cert/key that apple issued to that developer (after coming to an agreement i.e - $$) - and, crucially, is different from the keypair that the device will use to actually broadcast. This is then validated by apple and thus allowed to be added to that apple-id's account and hence on to the app.
The keys broadcasted by the devices themselves in 'lost' mode (i.e. not in 2 way contact with the owner's device) are arbitrary and completely opaque, Apple doesn't have any way of tying them to an ID or device or developer. This is how the proposed project here works - these keys will always find their way to the apple server.
It seems like the knockoff ones have just hijacked a legit key for the pairing process. This means if Apple desires and finds out the key, it can probably remove all devices from all accounts - although the devices themselves will keep on broadcasting and their locations could be accessed in the above janky way. I wonder too if the original key owner might get a large bill for per-device royalties if/when Apple searches it's DB for a count of 'devices-added-to-an-apple-id-signed-by-this-key'...