I see this as a chicken and egg issue. Small competitors like SailfishOS and GrapheneOS already face the challenge of having a comparatively minuscule customer base.

The way the EU and some other countries approach issues like this is to consider Apple and Google regulated monopolies. They must allow alternative app stores and follow other rules that normal non-monopoly businesses don’t have to follow.

There’s nothing about device attestation that is any more or less challenging than their status quo predicament.

Somewhat related, on the HN home page today: https://news.ycombinator.com/item?id=50217495