I've replaced fid files directly with no bad effects observed. Like, with a file of a different size entirely (but still id3v2 tagged).

Knowing the fid of the mp3 file isn't hard; Someone else already wrote a database parser. It involves the lrc file also being somehow tied to that fid, and I'd argue that's the uploader's problem.