The exploit would be on Apple’s backend servers rather than on device, with some jailbreaks you can bypass activation lock but your unable to use Apple services or even some functionality such as cellular. For an activation bypass there either needs to be a backend server exploit or an apple employee working with the service.

I can only vouch for Apple certified repair technicians but we need to have the customer provide proof of purchase such as a verified receipt and we can fast track the unlock process by sending it directly to the iCloud support department but we can’t unlock the device in our store and we can’t even take the device in for repair if the customer is unable to prove the device is their own(generally this is just unlocking the device or logging into their iCloud account and checking that the serials match but a original receipt also works)

Serialization is only on certain parts so things such as housings or charging ports still have good value and serialization is on a specific chip so while those parts do sell for less, a skilled repair technician could move the chip over assuming the whole part isn’t fried and it’s just damaged. There is less value in locked phones but there is still material value and they often steal the phone then get the phone number for the device and try to trick the user into removing the device or phishing their Apple ID as find my doesn’t require two factor to remove, only the password.