You can't really do that with safetynet, as it relies on sending an (often signed with a hardware key) payload to the servers of the app, which then connect to Google's server for validation, before allowing access to the APIs the app requires.

The checks I've seen when I have explored the possibility of doing this (in an explicitly legal way, I had permission) were easily bypassable client-side. It's not generally a good idea to assume the heaviest option was picked when a simpler one could also have been picked.

Not really. Safetynet runs on Google servers and communicate with your banks servers (if they have that enabled). If a modded app removes these checks, the bank will notice because they ask Google whether your device fulfills all requirements.

The problem is SafetyNet uses remote attestation. And if the bank app is implemented properly that won't work because the server will check they attestation and fail your login. They very well may not bother with this though since they offer a web version anyways... which kind of makes the whole idea of putting root checking in the app pointless.

Right now at least, there's no hardware attestation on many devices so you can just install Magisk and hide the fact you're rooted pretty easily from SafetyNet and still pass.

> Right now at least, there's no hardware attestation on many devices

How long do you think it will be before a country requires that all smartphones support this? And how long before it is a requirement for laptops too?

not sure about smartphones but Windows 11 will require a TPM, presumably for remote attestation

That's a good point. Anyone who suspects that the government pressured Apple to add on-device file scanning (under the guise of "think of the children") should also conclude that making TPMs a requirement is intended to lay the groundwork for a future legislative change (presumably under the guise of "cyber-security").