If we were talking hardware where evidence of tampering was explicit I would agree but we are talking about a software modification.
I would place the burden on Apple to prove that a specific software modification caused the problem and if they couldn't, I would expect Apple, at a minimum, to reflash the device back to out-of-the-box, AT&T locked condition.

Outside of a dog -- a book is a man's best friend.
Inside of a dog it's too dark to read.