Sure, Google was betting that bureaucratic companies would enroll voluntarily and it worked.

> Like with reCAPTCHA, there are other services and libraries out there to detect root access and other things companies want to detect in their apps.

My opinion on this is that any method to check integrity, root access or if developer mode is enabled is a security vulnerability by itself, no such app should be able to know that.