Just extract the device certificate from one device and store it on another. Problem solved.
Extracting data from the TPM or equivalent stores in ARM devices is also not impossible, as the DRM-breaking community has shown with extracting keys from TPM-based DRM.
Google can only verify what hardware you're running by sending a packet via ethernet to your device. You control all software running on your device, and can send a spoofed result.
If you were crazy, you could even just emulate Google's hardware entirely and proxy all requests to that emulated hardware.
Nonetheless, while this guy certainly wouldn't be able to do it, many Google employees would.
They're already doing something similar, after all.
Handwaving away all of this as just a minor nuisance is silly. An attacker would have to find some unknown side channel or try to physically modify the TPM to get at the data, either approach means the attacker has significant resources, certainly well beyond the means of our hypothetical attacker. Heck, it's been speculated that even the NSA couldn't get data out of something like Apple's Secure Enclave without risking destroying it in an attempt.
I’m more surprised a Google engineer couldn’t circumvent it.
Yes, of course it can be broken, it only takes 2^256 attempts in order to do so.