NDA or not, SOMEONE would open that thing. I don't think there is bupkus in those boxes (if they exist). If Apple is only sending 1 out to retail outlets, what's the value versus risk in getting the box to the outlet ahead of the announcement? Specifically, here in the US, any overnight service could have it there by 10:00 AM this morning, just ahead of the announcement, but not so early as to attract sticky fingers.
Then, if the phones are not going on sale until later this month, what's the value versus risk of having an actual phone onsite today versus tomorrow? Too much risk, and not enough benefit, to having those single phones at the outlets simultaneous to the WWDC Keynote.
Finally, and most importantly, if the US boxes say Do Not Open Until Monday, it's Monday right now. They could have been cracked open at Midnight and still been within the photo (shopped?) NDA details.