bagel afaik that kind of tampering should not be possible under normal circumstances, and you could verify that it's still running graphene here
Hash was correct, no PIN was ever entered, device was wiped and then fresh install was given via ADB sideload before giving it to happy new owner. (also all stuff was disclosed <3)