It's not hard to bypass attestation, it's actually very easy and done right now at scale, there's giant click farms with phones on racks.

They don't modify any device and will pass whatever attestation you try to make.