[Moto G4 Plus Guides, News, & Discussion] echo92:
I think any scenario where your system is mounted read-write, as in the scenario you present, would cause a change in the overall hash used to calculate that particular partition, and cause the verification to fail. So, yes - I imagine this is to keep manufacturers/general users/financial institutions/regulatory and government authorities happy, to maintain as strict security as possible. Unfortunately, it seems that users wanting root/more power are increasingly outnumbered by the number of users/organisations wanting a device they can trust in terms of security, and that's just been increasingly so as Android is updated, hence the increasingly stringent security implemented and Google's efforts to make rooting harder. This post from Chainfire, developer of SuperSU, might prove enlightening: https://xdaforums.com/showpost.php?p=68424605&postcount=2

Technically, even Motorola has not released any stock ROMs barring the few on its website - recently, many of the stock ROMs are leaks from the Motorola firmware server (as I understand it, mainly for service centres). Motorola builds the new ROMs, signs them, then uploads them, where they appear to be captured for our use.

Of course, it's good to be wary of the source of these stock ROMs, though the inbuilt cryptographic key signing and the security certificates should verify to your device that the firmware is genuine. As I understand it, bootloaders, especially locked bootloaders, can reject firmware not signed with the right keys/certificate, as described here: http://newandroidbook.com/Articles/aboot.html and here: https://www.usenix.org/system/files/conference/woot17/woot17-paper-hay.pdf If a user attempts to lock their device with non-genuine firmware, the lock should fail. Furthermore, dm-verity may block your device from booting if you did have unsigned files/partitions on your device with a locked bootloader, as the overall hashes would not match that expected by the bootloader and the chain of trust. The bootloader seems to be also verified by the hardware OEM key, so unless you've got access to the private keys by Motorola, it seems quite unlikely that the stock ROMs are not genuine if users have reported they can lock their bootloaders and boot with that particular firmware. Furthermore, OTA updates appear to be signed by Motorola, so if your base firmware is not modified but not genuine, I imagine then the OTA update would fail as the certificate may not match that from your firmware https://source.android.com/devices/tech/ota/sign_builds However, from the Moto G4 Plus stock ROMs I've flashed on my XT1642 from the various links on XDA (MPJ24.139-63, NPJ25.93-14, NPJS25.93-14-4, NPJS25.93-14-8, NPJS25.93-14-10), each of them has accepted OTA updates from Motorola with no issue, suggesting that they are genuine. Of course, caveat emptor.

However, you need to be very careful if you're attempting to flash older stock firmware than what you have on your device, then update via OTA updates. We have had multiple instances where users have downgraded their stock firmware, and then hard bricked their devices when taking stock OTA updates.

This appears to be as a result of downgrading, which does not downgrade your bootloader. So you've got an older system but a newer bootloader. Now, when the OTA update is installed, the signature checks are applied to your /system and /modem partitions, for example (I can upload an updater script file for you to look at, or any OTA update file, in the zip file, it's under META-INF/com/google/android/ ) so the update verifies it's flashing to the right system and the partitions are not modified.

Tellingly, the OTA update does not check if your bootloader is the correct patch level - I'm guessing the assumption is that your device firmware and your bootloader are of the same patch levels.

Normally, that would be the correct assumption. However, by downgrading your stock firmware, this assumption no longer holds and the OTA - as it appears to have authorisation, perhaps from having the correct keys - can flash the older bootloader files (raw aboot, sbl/sbl1 images, for example) to your bootloader, corrupting it in the process and causing your device to fail to boot whatsoever.

We do have a blankflash to help try rescue your device, but as Motorola updates the bootloader, this may not work. Custom ROMs should not touch the bootloader, and I notice you've mentioned possibly moving to them, so if you don't wish to mess around with stock firmware, it's an option.