[Magisk] pndwal:
My personal view is that it's the other way around...

Google have been obliged to compete as a mobile OS provider by supplying a means to obtain a strong attestation based verdict for device integrity* and they did that as early as they supplied evaluationType along with ctsProfileMatch which is now just simplified as deviceIntegrity.

*Nb. Many corporations, government agencies etc see IOS as the only properly secured mobile OS ATM, and many already issue these devices while requiring employees to ditch Android devices...

Banks never took up the opportunity to use this mechanism simply because it would force their customers to purchase Android 8+ devices, and even if customers did so they would still not be able to use Bank apps if the device chosen was OnePlus or various others with broken keymaster implementations or devices where Google revoked keys for strongIntegrity...

Rather than waiting for a green light from Google, I think that banks etc are simply waiting until the critical mass of devices with keymaster 3+ / Android 8+ (in combination with a consideration of the number of modern devices, OnePlus and others, that still have broken keymaster implementations and can never pass the stongIntegrity verdict) can be considered sufficient to justify enforcing strongIntegrity... Then they will simply move to adopt that option and accept as 'colateral damage' the customers who can no longer run such bank apps etc, ie. with any older (A7 and earlier) device as well as many (notably OnePlus but also some RealMe, Xiaomi, other) devices with busted OEM keymaster, not to mention devices with unlocked bootloaders...

FWIW, I believe this decision is still a way ahead as banks will be hard pressed to make the move with this known casualty list... This would be felt especially in countries where many users still have old devices as well as by those in other lands holding on to old high-end devices...

I don't imagine Google will preempt this move however... I also think they may have acted with goodwill towards the modding community when implementing their droidguard VM based device integrity attestation system as it seems it would not have been hard to include hardware keystore backed attestation to device model with integrity verdicts... Then banks etc could have applied strongIntegrity attestation on a per-device basis with no bypassing possible. ☹️

If Google had done this we would surely have seen an evaluationType/ctsProfileMatch, now strongIntegrity, verdict take-up from the get-go, and, while verdicts would likely not have been enforced across the board, users of modern modded devices with healthy OEM keymaster implementations would certainly have been unable to use bank apps for some time already. 😶

It's like Google have done us a favour by not allowing exclusive use (it's all devices or none) of such strong attestation verdicts for device integrity...

I do think Google will be obliged to move to adopt strongIntegrity for G Pay, Playstore etc once banks do, and my (educated) hunch is that Google is actually waiting for banks to move / green-light this...

So, if you wish to have a customised daily-driver phone in your pocket, it seems that you may also need to carry an unmodified one in your other pocket... eventually. 😬 PW