They would have to put the condition inside shared library .so and use Android JNI. Make it complicated and hide the string tablet model throughout the code, just enough time to frustrate whoever is decompiling the so file.
If they want to really do it wrong (or right, from their PoV), they require the communication with the base station to be signed with a certificate signed by their root CA, and put the private key of that certificate in the TPM.
