most times it's done by (reliably re-)rooting a attested phone in a way which bypasses detection of the attestation system

so not really useful for 3rd party ROMs

Quite useful for scammers, though, which is why this is so irritating with regards to digital IDs.