>FTDI chips keep there USB product ID in a mask ROM.
No it's not. You can change it even on real devices.
The way they are detecting fakes is by doing a write to EEPROM with a width that the real devices ignore. If the data on the EEPROM changes they know it's not a real part because the real part would have ignored it.