...There may be a hack to get around this (e.g. maybe it's possible to install AT&T-XP3 firmware on the Sprint-branded XP3), but I'm not really aware of one.
Even if one can install new firmware, the IMEI would still not clear the whitelist check. (AT&T still will see it as a Sprint XP3.) If AT&T sweeps the system for whitelist checks on MVNOs, as they're currently doing on AT&T's self-owned providers, it would likely still get suspended.
I'm a little confused. What does "self-owned" mean here?
AT&T owns AT&T Prepaid of course, but they also own Cricket: properly, Cricket is not an MVNO. The AT&T corporate device restrictions (whitelist) have applied to Cricket just as they do to AT&T Postpaid. At this point, AT&T hasn't forced MVNOs to apply the very restrictive whitelist system. (We're just starting to see evidence that they might, with one Tracfone user reportedly receiving a warning about an AT&T network phone not on the whitelist.)