[Magisk] pndwal:
But registration actually tells Google that device has NOT passed CTS/VTS certification so should NEVER pass Play Protect certification!...

I have wondered if registering causes issues for modded users using spoofing solutions in the past... It seemed not to cause issues, but I did give this advice:

By registering the ID, GMS suite (read GApps) becomes usable on China non-certified devices since Google began (in March 2018) to check the security patch property and prevent devices from using the Google Framework if patch was dated later and didn't match a certified fingerprint... The GSF ID then blocks Google account creation (ie use of Play Store etc)... The registration option is a concession for custom ROM users...

Background: This was a good-will gesture to modders after implementing the block for GF and adding Google accounts to thwart the tide of unscrupulous re-sellers shipping cheaper uncertified China region-locked devices with modified (and shonky) "global" ROMs and GMS suite pre-installed which is illegal and bad for everyone except the sellers... It wasn't intended to disadvantage modders who often do much the same thing... Making the registration option available proves Google only wants to stem the abuse perpetrated by commercial operators.

It appears that Google is able to determine that a device was certified by the GSF ID even if GMS sees S/N ctsProfileMatch or the more current PI DEVICE_INTEGRITY failing and therefore don't block users creating Google accounts... With devices determined not to have been originally certified (eg China region), they apparently check the registration database to see if device has been whitelisted to allow use of an account for an uncertified device using a custom ROM in the event that PI DEVICE_INTEGRITY fails.

... Registration does NOT mean device is now certified however.

To the contrary, registration could potentially be used to signal that the device has not passed CTS/VTS and should NOT in fact be passing Play Protect certification, ie that PI DEVICE_INTEGRITY must be spoofed...

Registration is therefore very good for users of China region (and other?) factory-uncertified devices who run custom ROMs without spoofing PI DEVICE_INTEGRITY, ie legitimately, as it's the means by which Google allows users of uncertified hardware to legitimately install and use GMS suite (GApps)... For those wanting to spoof Play Protect certification however, registration could be a way to shoot themselves in the foot... The legitimacy of this approach is also an entirely different matter. 😬

Nb. Unique GSF ID is requested from Google

as soon as you log to your Google Account for the first time and will normally be changed only with a factoy reset, but there are various scripts etc floating around the interweb that apparently enable users to reset it without setting up a new account or wiping data... I'm not aware if an in-use GSF ID registration for whitelisting purposes can be revoked (or deregistered) however.

----
​

Apart from all the above, please say what Pixel tablet you have... If a fairly late device Play Protect may be separated from Play services to it's own app... The fix may be as simple as this:

Hope it helps. 🤠 PW