That's not really surprising. Limited attestation of device state has been a thing for a long time and it's why Chrome is used at so many companies.