I would suspect that it's because for older devices without hardware crypto processors/certs it's impossible to distinguish between a real device and a Hackintosh (or Beeper client) that's spoofing a serial number. So while validating against a known list makes things harder, it's still not truly "secure" in the sense that older, yet still supported devices (like the 2015 MBP that I had up until about a year ago) aren't able to prove that they're actually the device, since they don't have a way of signing that proof in a way that Apple can verify.