The counterfeit number actually proves my point: the harm is selling fake chips, not measuring real ones. Fraud, trademark, and patent law already cover that. Your pacemaker example cuts the other way; an attacker reverse-engineers regardless, while a legal researcher can find the flaw first. Always legal targets the act of observation, not publication of stolen designs or weapons data, which separate laws can restrict. If you criminalize analysis, you do not stop bad actors; you just make security and repair depend on manufacturer permission. Narrow rules have already failed to keep up.