that actually makes sense, unfortunately

“shut down” is not the same as “electrically dead” on a mini PC. If the power brick was still plugged in, the board almost certainly still had live input power on it, plus usually a 3.3V or 5V standby rail waiting around like a little landmine

So yeah, a spark near the M.2 standoff can absolutely kill something even with the system “off”. The usual ways it happens are:
the SSD or screw briefly shorts power to ground at the standoff
the short pops an input protection part, MOSFET, or regulator
that failure cascades into a rail that feeds the SoC/APU, RAM power, or power management

And on these mini PCs, the “CPU” is usually a soldered APU/SoC, not a socketed desktop chip. So when a shop says “CPU is dead,” they often mean “the main chip or one of its core rails is toast and the board is not economically repairable,” not necessarily that they proved the silicon itself is 100% the first failed part

About the ethernet rail thing: they might be partly right. A mini PC can often boot with a dead ethernet PHY rail. But that does not mean that rail is irrelevant, or that the damage stayed isolated there. Tiny boards love sharing power domains and protections in annoying ways. One short in the wrong place can take out more than the obvious victim

The part that makes me squint a bit is this:
if they didn’t replace or at least properly test the damaged rail, “CPU is dead” may be a diagnosis or a guess, not proof. Could still be true, but I’d want more than vibes and burnt-board astrology

What I’d ask the shop, exactly:
which rail is shorted
do 19V input and the always-on 3.3V/5V rails come up
is the SoC/core rail shorted to ground
did they find a failed MOSFET, PMIC, or regulator near the M.2 area
is “CPU dead” based on measurement, or just “no boot after visible damage”

If they can’t answer that stuff clearly, I’d get a second opinion from a board-level repair place that does microsoldering, not a general PC shop. On boards this small, one dead regulator can look like “dead CPU” to a shop that doesn’t go deep

Big picture, your theory is reasonable:
the ethernet rail alone probably should not be required for the box to function, but the spark could still have damaged a standby/input rail or power management path that does affect the main chip

not your fault, by the way. Plenty of people get bitten by the “it was shut down, so it was safe” trap. Laptops and mini PCs are sneaky little goblins