What’s so special about bar codes that the testers couldn’t create one themselves?

Are they cryptographically signed by a system that was inaccessible?

Or is it just a matter of figuring out the bar code format and writing out some KCM id?