As I said this was a test for the Mega328P not the 16U2. Yes the first few bytes are the device ID and it contains miscellaneous other information. Some of it is documented here and other parts on the data sheet. Copied Mega328Ps seem to have more FF than genuine ones (see the link in the thread).
As for the "16U2": since I can't reprogram it in any way there aren't many tests I can do with it. I wonder how many people have these boards and don't realise since they never tried to put them in DFU mode?
Before this I'd had good experiences with Aliexpress: pretty much every board I had worked fine.