Device based attestation seems like the way to go largely; it doesn't solve the problem, but it's good enough that it would cover most cases.

Not really. It just pushes the responsibility onto parents, who already have no idea how security works or what their kids are doing on their phones.