It's because of the Play Integrity API, which AFAIK runs downloaded binaries in the DroidGuard environment: https://en.wikipedia.org/wiki/Play_Integrity_API

The strongest levels require hardware key attestation (which, in my understanding, uses a certificate that's baked in secure hardware and signed by Google): - https://grapheneos.org/articles/attestation-compatibility-gu... - https://developer.android.com/privacy-and-security/security-...