the last time I checked, Subaru was not able to verify that the ECM had been tuned. They are able to see that it’s locked (obviously) and that the check sum has been incremented. The way I understand it, if there were 3 updates the check sum should match. If the check sum is 10 then it’s likely the ECM was flashed (tuned).
I believe there was also something about a length of time since last flash, meaning a check sum of n+1 but with a write time just before coming in for warranty would throw more flags than if it was years old.
What I don’t know is whether the modern ECMs show more than the above. There’s a huge difference between guessing that a +1 check sum means a tune and knowing for sure that the last write was from X tuner or at least not from an authorized write event.
Now, if this dude left the tune installed and brought it in then he‘s just an ID10T