From the story, it sounds like the client actually cared about the security of these devices. I would be somewhat surprised if they were left unobserved long enough for someone to surreptitiously carve out the epoxy and attach a drive to it.

Though, we can't know if the client was looking for intrusion prevention, or merely after-the-fact intrusion detection. :)