Device doesn't have to be rooted to spoof the location.

Also, I hope you're not using Play Integrity (lol), because that means all the old phones you allow can be rooted, hide it from you and/or spoof positive chdck result........ because they're insecure like sieves..... Whilst you'd be banning modern and unrooted phones.