Attestation is to your advantage if your phone gets rooted/hacked (evil maid attack). It will let you know that something is wrong when you try to login into an attested site.

Like SecureBoot.

never, ever in my life I've seen SecureBoot doing anything ever remotely advantageous for me.

the reality is that evil maid attacks, and more broadly (and realistically) physical access attacks are exceedingly rare. The vast majority of stolen credentials are phished or some other social-engineering trick, not James Bond sneaking in with his badusb.

Then you just entered your unlock code / password into the compromised device which immediately transmits it to the attacker who has your real device.

On top of that, secure boot doesn't require remote attestation. If your device doesn't like the new configuration then it doesn't release the key. The site has nothing to do with that except insofar as you need the key to sign into it. Your device manufacturer's key doesn't have to sign anything, all your device has to do is not give up your key unless the device is in the configuration you specified. And if it will do that then it would also sign an attestation to the same effect, so remote attestation still provides you with no advantage whatsoever.