> Just because an antivirus isn't perfect that doesn't mean it's useless.

If the security of your system depends on the attacker not doing something the attacker can easily do, it's useless.

> A bank may not want to put in the extra effort of supporting 3 platforms of secure phones, insecure phones, and insecure web and would prefer to support less and potentially dropping features from the web platform.

So now we've gone from some kind of hypothetical security benefit to "banks don't support that because they're lazy". Except that adding support for attestation is work they do for no reason, because the people using locked phones are still using locked phones and preventing people with unlocked phones from using them instead of the web page is paying to do work only in order to cause customers trouble.