There are multiple public bypasses for SafetyNet. Many 3rd party roms provide them out-of-the-box. Granted, Apple's attestation is bypassable as well.

Furthermore, others mentioned that a large portion of SMS-spam originates from the FluBot infected Android devices. Well, the only reason FluBot does not infect iPhones is laziness - it is perfectly doable at scale using custom configuration profiles.