I don't think there is an actual written regulation that talks about attestation or SafetyNet.

I can imagine in some meeting with the ministry or an industry association that somebody in charge said "implement all safety measures that Google and Apple provide, no excuses" and they just execute it.

I could also imagine there is a real need to do so. Maybe somebody found that criminals use rooted phones to robotically launder money or something like that. Or there was a criminal case where someone got a bank account with a fake ID and used it on a burner phone. Then the developers get a discrete notice from law enforcement or regulatory bodies and are told to close that gap. Who knows?