1) WEI doesn't attest that your device isn't running malware, it attests that your device is running a particular set of software -- it is a positive filter, rather than a negative one. This means that you can't run your own software (if it's part of the WEI trust chain), even if you know it's not malware, without changing the attestation (and see the next point for why this isn't viable).
2) Because WEI doesn't have a way to prove that software is malicious or not, it instead requires you to trust the attestor (in a cryptographically secure way). In the usual case, this will mean trusting Google. This means that if I write my own attestor, there is no particular reason that people should trust what it says. On the other hand, there are plenty of reasons to trust what Google says, given that they wrote the software and certified the phone. The attestor model, because it relies on trust, is fundamentally biased towards organisations which you already are obliged to trust to some extent.
The same arguments apply to metal detectors. This isn't about detecting metal (negative filter), it's about detecting approved clothing.