[Magisk] pndwal:
Google knows S/N / PI are easy to bypass, but don't seem to regard the 'white hat' modding community as high risk, and aren't in a big hurry to preempt enforced use of hardware based attestation verdicts either... In this sense they don't seem to be working against this community (contrary to what some Google haters keep asserting) at all, but they do need to be seen to be providing reliable means for developers of security dependant apps to determine if runtime environment has been tampered, so they've provided evaluationType and strongIntegrity attestations capable of doing this...

The issue for banks is that there there is no inclusion of hardware-backed device model labels with these attestations (at best they can poll props for such information which can be spoofed) which means that there is no assurance that deploying evaluationType or (current) strongIntegrity attestations in their apps on a per-device basis won't be bypassed any more than the likes of deviceIntegrity verdict...

This means that Google have effectively ensured that strongIntegrity verdict needs to be deployed access the board (if at all) to be totally reliable, and that users of any devices launched with Android 7 or less (incl. those now running up to date A12, 13 etc) as well as so many modern OnePlus and other devices (all launched with broken keymaster implementations at least until very recently) would be collateral damage in this event.

... So banks have understandably held off from using the foolproof strongIntegrity (and previous evaluationType) verdict... I believe Google intend to leave things this way and not preempt its use, ie they'll let the banks choose the time (when they deem there is sufficient market saturation of A8+ devices etc) to migrate apps to strongIntegrity verdict use... (New meaning to 'Google is your friend '?)

This also means (as I see it) that Google won't ever use root detection methods other than PI deviceIntegrity for Google Pay (they simply don't want to be seen to lack confidence in their own API for code execution environment security) at least until strongIntegrity is adopted by banks as the necessary new level of gatekeeping required for environment security... At that point I predict that Google will also follow suit...

Banks, on the other hand, have no such qualms using as many extra means to detect device/execution environment tampering as are available, and will often spend money/resources to develop new ones... These generally use PI deviceIntegrity API, but already augment this with a substantial (and. growing) list of root/modified environment detection means, many of which can be bypassed but tools like Skamiko, HMA etc...

So while Google Pay and many banks need nothing more than PI deviceIntegrity passing, other banks, increasingly concerned about (and affected by?) nefarious use of integrity API bypass mods to commit fraud, require methods equal to their integrated security engines (eg Promon) and their customised detections to fool apps into running on modded devices...

I believe this game (both of developing new tactics to coner the mouse, and of developing new methods to outsmart the cat) will only (finally) end with strongIntegrity deployment by banks...

The cat will win and have supper then... but we can have some fun meanwhile... 😝 PW