Well, that's very interesting! I based my message on what the OpenRosa spec states but I didn't actually verify what functionality Collect has. It looks like for some reason it has never sent deviceId with the formList request.
The good news is that this makes the change even less risky since it couldn't have been used for logic to filter form lists.
The bad news is that we have to make an explicit decision about whether to maintain this deviation from the intended specification or add the deviceId query parameter. I think we should not add support for it now. It was always easy to falsify and won't be guaranteed stable anymore moving forward. Instead, we should encourage use of different accounts to filter form lists, as Aggregate, Central and many different servers do.
You'll need to either target API < 29 and use devices < Android 11 to maintain usage of the IMEI, switch to the new install-based identifier we've described in this thread, or use accounts to do the filtering.