Optionally. And passkeys attestation only covers the HW key for example, not the OS running the website or the website. You're still completely free to re-implement it your way + FIDO2 is a standard, so eg. if you want to write your own native app for the bank web API, or whatever else, you can and passkey attestation will not stop you.

Android app/os attestation on the other side is a complete lockdown that prevents you from creating your own apps on top of server side apis the original mobile apps use.

So get them to remove support for device attestation from the spec, or don't use passkeys.