[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] Blu-eyes:
I understand your question but as stated here (Page 7):

https://static.sched.com/hosted_fil...Virtualization-Bing-Zhu-Intel-Corporation.pdf

Notes: Without RPMB key, read access is still possible, but the data being read may not be
authentic (no guarantee of data integrity and replay protection). Hence, RPMB doesn’t
provide data confidentiality protection (encryption is done by software if necessary)

So Using A brand new chip will allow all write/read operation, It will just ignore the key, and work like "a normal" storage without protection.

Another way to overcome this issue is discussed over the OP-TEE(Open Portable Trusted Execution Environment) on GitHub Issues where someone said that if the TE firmware detects that no key is present it will be programmed.

Here are some Qualcoom docs refering to RPMB https://www.qualcomm.com/media/docu...h-the-qualcomm-snapdragon-mobile-platform.pdf :

I also done a simple/quick research about the XZ2 boot, I've compared the stings referring to RPMB in the bootloader and here is the diff:

--- XZ1_sorted.txt	2019-10-05 11:10:24.560753970 +0200
+++ XZ2_sorted.txt	2019-10-05 11:10:36.804844396 +0200
@@ -1,11 +1,47 @@
-abl.mbn: rPmb
+cmnlib64.mbn: cmnlib_gppo_rpmb_enablement
+cmnlib64.mbn: qsee_query_rpmb_enablement
+cmnlib64.mbn: qsee_rpmbw_add_partition
+cmnlib64.mbn: qsee_rpmbw_client_get_info
+cmnlib64.mbn: qsee_rpmbw_device_get_info
+cmnlib64.mbn: qsee_rpmbw_init
+cmnlib64.mbn: qsee_rpmbw_open_partition
+cmnlib64.mbn: qsee_rpmbw_read_sectors
+cmnlib64.mbn: qsee_rpmbw_read_wp_config
+cmnlib64.mbn: qsee_rpmbw_remove_client
+cmnlib64.mbn: qsee_rpmbw_write_sectors
+cmnlib64.mbn: qsee_rpmbw_write_wp_config
+cmnlib64.mbn: version_Init_Rpmb_Partition
+cmnlib64.mbn: version_Is_Rpmb_Usage_Enabled
+cmnlib64.mbn: version_Open_Rpmb_Partition
+cmnlib64.mbn: version_Protect_And_Write_Rpmb_File
+cmnlib64.mbn: version_Read_And_Verify_Rpmb_File
+cmnlib64.mbn: version_Read_Rpmb_File
+cmnlib64.mbn: version_Write_Rpmb_Partition
+cmnlib.mbn: cmnlib_gppo_rpmb_enablement
+cmnlib.mbn: qsee_query_rpmb_enablement
+cmnlib.mbn: qsee_rpmbw_add_partition
+cmnlib.mbn: qsee_rpmbw_client_get_info
+cmnlib.mbn: qsee_rpmbw_device_get_info
+cmnlib.mbn: qsee_rpmbw_init
+cmnlib.mbn: qsee_rpmbw_open_partition
+cmnlib.mbn: qsee_rpmbw_read_sectors
+cmnlib.mbn: qsee_rpmbw_read_wp_config
+cmnlib.mbn: qsee_rpmbw_remove_client
+cmnlib.mbn: qsee_rpmbw_write_sectors
+cmnlib.mbn: qsee_rpmbw_write_wp_config
+cmnlib.mbn: version_Init_Rpmb_Partition
+cmnlib.mbn: version_Is_Rpmb_Usage_Enabled
+cmnlib.mbn: version_Open_Rpmb_Partition
+cmnlib.mbn: version_Protect_And_Write_Rpmb_File
+cmnlib.mbn: version_Read_And_Verify_Rpmb_File
+cmnlib.mbn: version_Read_Rpmb_File
+cmnlib.mbn: version_Write_Rpmb_Partition
devcfg.mbn: cmnlib_gppo_rpmb_enablement
devcfg.mbn: OEM_allow_rpmb_key_provision
devcfg.mbn: OEM_counter_enable_rpmb
devcfg.mbn: OEM_disable_rpmb_autoprovisioning
devcfg.mbn: OEM_keystore_enable_rpmb
keymaster.mbn: Adding RPMB data to memory, device was rebooted:%u
-keymaster.mbn: cmnlib_gppo_rpmb_enablement
keymaster.mbn: Failed in km_check_key_id_rpmb:%d
keymaster.mbn: gk_delete_all_rpmb_data
keymaster.mbn: gk_delete_rpmb_data_uid
@@ -18,6 +54,7 @@
keymaster.mbn: km_check_key_id_rpmb
keymaster.mbn: km_delete_all_keys_rpmb
keymaster.mbn: km_delete_key_id_rpmb
+keymaster.mbn: qsee_query_rpmb_enablement
keymaster.mbn: rpmb_alloc
keymaster.mbn: rpmb_alloc_read
keymaster.mbn: RPMB buffer invalid
@@ -31,22 +68,24 @@
keymaster.mbn: sfs_rpmb_set
keymaster.mbn: soter_rpmb_alloc_read
keymaster.mbn: update_soter_rpmb_header
-keymaster.mbn: version_Init_Rpmb_Partition
-keymaster.mbn: version_Is_Rpmb_Usage_Enabled
-keymaster.mbn: version_Open_Rpmb_Partition
-keymaster.mbn: version_Protect_And_Write_Rpmb_File
-keymaster.mbn: version_Read_And_Verify_Rpmb_File
-keymaster.mbn: version_Read_Rpmb_File
-keymaster.mbn: version_Write_Rpmb_Partition
tz.mbn: OEM_allow_rpmb_key_provision
tz.mbn: OEM_counter_enable_rpmb
tz.mbn: OEM_disable_rpmb_autoprovisioning
tz.mbn: OEM_keystore_enable_rpmb
+tz.mbn: /storage/rpmb
tz.mbn: tzbsp application rpmb version rollback label
-tzxflattest.mbn: clr_rpmb_sector: Bad in_len %d
+tzxflattest.mbn: clr_rpmb_sector
+tzxflattest.mbn: clr_rpmb_sector: Bad payload len %d
tzxflattest.mbn: clr_rpmb_sector: Not allowed to run
tzxflattest.mbn: clr_rpmb_sector: qsee_is_sw_fuse_blown() failed:%d
-tzxflattest.mbn: get_rpmb_sector: Bad in_len %d
+tzxflattest.mbn: get_raw_sec_data:rpmb xflsecdata is empty
+tzxflattest.mbn: get_rpmb_sector
+tzxflattest.mbn: get_rpmb_sector: Bad payload len %d
+tzxflattest.mbn: get_rpmb_sector: Bad payload len = %d, RPMB sector len = %d
+tzxflattest.mbn: is_rpmb_provisioned
+tzxflattest.mbn: RPMB boot is NOT provisioned
tzxflattest.mbn: rpmb_init failed
+tzxflattest.mbn: RPMB is provisioned
+tzxflattest.mbn: set_rpmb_sector
tzxflattest.mbn: set_rpmb_sector: Not allowed to run
tzxflattest.mbn: set_rpmb_sector: qsee_is_sw_fuse_blown() failed:%d

As you can see in The XZ2, there are more references to RPMB, especially in the cmnlib64 and the tzxflattest.

The diff is Against the latest XZ1 (Customized IT) and the latest XZ2 (Customized IT) firmware, and againt the bootloader specified in boot_delivery.xml for production devices.

I can be extremely wrong on the RPMB, but now this is the only thing that I know that is quite secure for these things.

If I remember correctly, also the Nexus 5X has some issue regarding DRM and RPMB (Searching for Secure boot: Enabled(NO RPMB) will point you to them)

Blu-Eyes