GOS's argument over the attestation is that it's essentially the same as Google's system. It approves the devices themselves regardless of their security. An approved device isn't more secure in any way just because it's on the list. It's just a way of arbitrarily excluding any OS that they don't like while still allowing devices that are obsolete or behind on security updates.