This is an intent thing. A protected auth checksum verification step could be the number of letters in the packet and still count, it is not a technical provision

Circumventing a xor by xoring it back is still attempted circumvention.