[Redmi K20 / Xiaomi Mi 9T Questions & Answers] zgfg:
And one more but very important thing

TWRP (backup) has NOTHING with SafetyNet. SafetyNet DOES NOT look do you have TWRP folder, or do you have Magisk app/mngr (I'm not talking about thevMagisk core/service but apk)

Unfortunately, there are too many unknowledgeable people writing that and similar nonsense elswhere

Problem is (and that's the reason why it might look 'similar' from the end user's point of view) that various banking apps, ganes and so, use VARIOUS methods and in some cases even speculative GUESSES trying to find if your device is SAFE for their apps and businesses (whatever that means for somebody), or is your phone 'rooted' (also in the very loose sense)

Those methods and guesses may include:

- Testing SafetyNet (framework provided by Google, partly in Google Play Services and partly on Google servers).

Fornally, when Bootloader is unlocked and/or with custom ROM (not certified with Google) or rooted (stock) ROM , you *should* fail SafetyNet - but there are methods to trick Google and still to pass SafetyNet.

Actually, to flash any such nod (custom ROM or recovery, or root, you first need to unlock Bootloader - and that's the first thing that SafetyNet looks for, but on some phones and ROMs it is possible to fool even the Google's SafetyNet)

That's the reason why thosre apps combine various other methods trying to find (or just to guess) if your phone is 'safe' or not

Some use sofisticated methods looking for su in the path or modified init.rc, or bypass Magisk Hide acting as isolated processes - that way finding the gllitches in MagiskHide making them possible to detect Magisk

But some use very PRIMITIVE guesses:

- If they find TWRP folder, they 'conclude' you 'must' be having TWRP, hence your Bootloader 'must' have been unlocked and you might have been flashed the root or custom ROM, hence they simply declare your phone as 'unsafe' or "rooted'.

But you could take 100% stock and not-modded phone and just create there a folder named TWRP on Internal memory - and your phone will fail their 'safety' pass (but not the Google's SafetyNet)

- Similarly, some just look if they find that the com.topjohbwu.magisk package installed (being Magisk apk, but that is not Magisk as core/service).

Again, you can take 100% stock, not-modded phone and just install there the Magisk apk (maybe, because you wantef to use its built-in SafetyNet checker), and those apps will declare your phone was 'rooted' - which is again total nonsense

On the other side, that is all about statistics. There will be let's say 0.001% of people who do have TWRP folder but not custom TWRP recovery and similarly 0.005% people who do have Magisk app but no Magisk

On the other side, 90% of people who do have custom Recovery will also have TWRP folder and 60% of people with Magisk service/core will also have Magisk app (formerly mngr) - the rest 40% of Magisk users will have hided/obfuscated/repackaged Magisk app (therefore, it cannot be found under the com.tophohnwu.magisk package name)

Hence those apps (and their developers, or better to say those who paid those developers to implemen that GUESSES) can take them rights to declare the phones with TWRP foldersor Magisk app installed as 'unsafe'

Those 1-5 users out of 100000, who by incidence do have TWRP folder (but no custom recovery) or Magisk app (but no Magisk) - bad luck, who cares about them

On the other side, that guesses (since they didn't come up with anything more sofisticated) will make them possible to catch 500 users with TWRP or Magisk, who tricked the Google's SafetyNet (but didn't even think about that primitive possibilities to 'catch' them)