[Chihuahua0633]

Matter specifies that all firmware images must be signed so the device can verify authenticity before installation, ensuring they haven’t been tampered with. Matter further requires mechanisms to prevent unauthorized firmware execution and ensure that firmware can't be downgraded.

Matter states that firmware images “may be encrypted.” This is not a requirement, though encryption is allowed and may add security

(https://community.arm.com/arm-community-blogs/b/internet-of-...)

[0x000xca0xfe]

This sounds like it only affects OTA updates going through the Matter stack, not an explicit requirement to block serial flashing.

Disclaimer: I haven't tried serial flashing of Shelly/Sonoff Matter-enabled devices myself, just remember some complaints of customers that failed to re-flash such devices.