> Allegedly can be spoofed.

Not on a non-rooted device, which won't pass attestation.