If they’re tampering with the hardware, then it’s reasonable to assume they are re-applying the stickers so that it’s not noticeable - most likely with authentic reproductions or possibly even genuine decals.
They could be dropping in a custom ROM chip which would be very difficult to detect unless you knew what you were looking for. Most likely though, they are low-level flashing the EPROM with custom firmware using TFTP and embedding it somewhere deep that the built-in flash utility probably doesn’t touch so that it can’t be easily overwritten.
Checksums are easily faked and are only designed to verify data integrity - not authenticity.
As to the the lack of visual indicators in the workspace, I highly doubt the NSA would have big signs in the background saying “Welcome to the NSA!”.
