>They should have used AOSP device attestation

No, they shouldn't have used any attestation. If they are using sound cryptosystem for their ZKPs, they don't need to care at all about what hardware and software I'm using.