this was supported with Xprivacy many years ago and it was fantastic, but it stopped getting support. The entire pro-privacy android scene seems to have become a very small niche over the years

That's mainly googles fault. Xposed still lives on somewhat with the Riru project, but even a rooted phone without any mods will fail securitynet checks today, rendering it useless for most consumers that would have been willing to do the process before. With every android version things become less modular and less moddable, so the community shrinks as a consequence.

It's still possible to use XPrivacyLua (https://github.com/M66B/XPrivacyLua) with passing SafetyNet. It's a cat-and-mouse game, but the community is still ahead.

You can achieve this with latest Magisk (v24+, https://github.com/topjohnwu/Magisk), enabled Zygisk and following modules:

- LSposed Zygisk (https://github.com/LSPosed/LSPosed, fork of Xposed)

- Universal SafetyNet Fix (https://github.com/kdrag0n/safetynet-fix)

- Shamiko [optional, more hiding but needs configuration] (https://github.com/LSPosed/LSPosed.github.io)

that's why this needs to be built directly into alternate roms, like graphene, /e/ or even lineage so this feature is available on those roms without the user needing to root their phone.

interesting. f-droid has an app called xprivacylua which seems to be a successor to xprivacy. last updated less than a year ago. the problem is that it requires rooting the phone which not many people will want to do, and the xposed framework comes with a big warning that it could prevent android from booting.

what we need is to have this integrated into the core OS so that it can safely be used by anyone.

Can someone explain this to me?

Have people just given up?

Yes, basically. After you root the device and install things like Xposed, "safety" feature called SafetyNet will most likely start reporting to apps that your device is untrusted. Google Pay, some banking apps and similar software may stop working or complain. There are still some ways to cloak the root and let SafetyNet pass but that may easily change with a simple Google Play Services OTA upgrade or something like that and it is simply not worth the risk for me personally. I don't want to spend days hacking around a recent update in order to regain the ability to pay with my phone, I don't want to block a queue of people when a payment machine displays generic rejection errors...

To be pedantic, if I just root a random device, but am very careful in terms of what I adjust... how does that fare?