Actually, they now check a fuse on the device to verify if you unlocked the bootloader – if you have, on some devices, safetynet will fail.

So, yes, they can do something: blow fuses in the fucking system.

From what I've seen, there are no actual cases of this in practice at least not on Google devices - Google devices don't even have such a fuse. Maybe some Samsung stuff - but that's an easy fix, don't buy from Samsung. Also, it does not fail SafetyNet even on those Samsung devices, just some Samsung-specific stuff.

From what I've seen the only mention of such fuses on Google devices is one that enables secure boot from factory and forces you to run the unlock command as I mentioned to reflash your bootloader - nothing to do with safetynet or anything similar.

Let me know if I'm missing a device which does actually do this. Yes, it's theoretically possible, but requires sufficient crypto hardware and protection to make it significant and it'd be a significant shift in direction for Google to go this route currently in my opinion.

Of course a full safetynet emulation that would spoof the check as a different device would also be an option... but it'd be a pretty big undertaking, but one which I'm sure would happen if this ever became a remotely significant threat.