The whitelist would be on the phone number/icloud id and not tied to the device.

That’d be pretty difficult to get second hand, especially when you can just spam over SMS.

They could even release a new iMessage protocol with another bubble color and let the blue ones become uncool.