And that’s it. The SCBO mystery is finally solved and its format understood. With the precious assistance of my EFI DXE emulator and debugger I sped up the reverse engineering effort. The SCBO feature design is robust, and the only mystery I haven’t solved right now is how someone is apparently selling working SCBO files on the Internet. My bet is on insider access to Apple systems via Apple Support centers or something like that, but once again only Apple can really investigate the root cause.
(my bold, YATO)
Here is what a commenter to the post had to say:
You can basically do anything with an Apple GSX account, so selling the file is not a news. You can unlock even more stuff with it.
Also, it’s not that hard to gain access to a GSX account, work for an APR and you are golden. Most of them don’t even bother to delete ex-employee’s account.