On mobile, rooting and using a hosts file to block malicious/ad domains is better anyway.
For me, the bigger issue with a hosts file is that it doesn't cover conditional cases. For instance, there are times when I want to read some comments or play a video, or even unblock a single page element, but otherwise I want to block that stuff entirely. Facebook comments is one example.
My recommendation is still to do both. Hosts file covers other apps nicely like stupid in-app banner ads, while using Firefox or something with ad-blocking extensions still lets you browse the web without breaking some sites entirely.
There should be a safety net remover that simply strips all safety net API calls off a program and inserts all valid flags by default.
SafetyNet actually sends its results to a Google server, which validates that they’re properly signed, and then sends a message to the backend of the app.
The only way to successfully break it is by emulating or replacing SafetyNet on the device, but as part of it runs in TrustZone, that’s not easily possible.
E.g., my Samsung Galaxy Tab A.
Fuck Google. Fuck Samsung. Fuck Android.