Pixel 2 and later had hardware attestation, not the Pixel 4 and later. Devices launched with Android 8 or later were required to support it.
Android hardware attestation using root-based verification is highly insecure. It depends on the weakest links in the overall ecosystem. There are tons of leaked keys from insecure TEE implementations. People can often even downgrade to an ancient TEE implementation to exploit it when anti-rollback wasn't used for updates. Devices never updated since launch can be used to get keys via known vulnerabilities. Google doesn't revoke all the known leaked keys because it would break compatibility across many devices. Originally, private keys were provisioned to 100k or more devices in batches. They've moved to a system where each can get a unique key and then the ones used by apps are dynamically rotated but it's only the Pixel 7 and later using it in practice for Pixels and other devices took far longer to adopt it. That only got forced in the past year or so for other devices.
Android hardware attestation using pinning is highly secure on devices with a good implementation but that doesn't work for this use case. It could work for giving out phones to people and then verifying those are still genuine, not tampered with and have continued applying updates on an ongoing basis.
Android hardware attestation using root-based verification is highly insecure. It depends on the weakest links in the overall ecosystem. There are tons of leaked keys from insecure TEE implementations. People can often even downgrade to an ancient TEE implementation to exploit it when anti-rollback wasn't used for updates. Devices never updated since launch can be used to get keys via known vulnerabilities. Google doesn't revoke all the known leaked keys because it would break compatibility across many devices. Originally, private keys were provisioned to 100k or more devices in batches. They've moved to a system where each can get a unique key and then the ones used by apps are dynamically rotated but it's only the Pixel 7 and later using it in practice for Pixels and other devices took far longer to adopt it. That only got forced in the past year or so for other devices.
Android hardware attestation using pinning is highly secure on devices with a good implementation but that doesn't work for this use case. It could work for giving out phones to people and then verifying those are still genuine, not tampered with and have continued applying updates on an ongoing basis.