Scammers could already find a way in by using certificates or something like that.

This is way harder and much more complicated than you’re implying. You basically need a targeted campaign against you and you’d have to be the only target for a period of time.