Of course they can do it by cloning the hardware and software so they have near zero development costs (and with the complexity of this generation of stuff and no public documentation the hardware...

Theres 2 types of tunerlock. There are just changing the security key - you can brute force this and then read with most tools (including mine). Then there is HPT proprietary tunerlock which applies...