After the device is connected, use looks like a key consistency aware system like an ssh client. It is as you note very different in the first protocol run.
To extract the device secret value, an attacker needs to connect the target device to an attacker device. As you note, the thunderbolt device leaks the secret value over the untrusted channel. Impersonation of that device after that moment is trivial as a result.
The entire cryptographic protocol is broken from the start.
