IIRC, every time each user's wallet comes online it requests their state (unless im mistaking it for the Data Loss Protection protocol). If it is a previous state then you'd know they were lying to you. It also makes it indistinguishable from a recovery event vs coming online, so it would be harder for them to decide when to give you an old state.

I may be confusing the two flows but i remember reading something like that when I was researching them.