Comment by charcircuit

>At which point hardware attestation accomplishes nothing

Attestation could be used to say that the user is not using a secure version of the OS That has known vulnerabilities patched.

>Any banking app is forced to support them or they will lose customers.

Remote attestation is just one of the many signals used for detecting fraud.

>one or more zero days

Many phones are not on an OS getting security updates. Whether that be due to age or the vendor not distributing the security patches. Even using old exploits malware can work.