How does their web site do device attestation? The argument that apps have to be locked behind a validation mechanism controlled by Google to be secure is BS when a cookie is sufficient.