It’s less about a "scan" and more about the "handshake." Look at things like Windows 11 requiring a TPM and Secure Boot, or the Microsoft Pluton chip being baked into newer CPUs.
They don't need to inspect your code. They just need a cryptographic "attestation" that says your hardware and kernel are in a "known good" state. If your DIY kernel doesn't have the right digital signature from the manufacturer, the service whether it's a bank or a Netflix stream, simply says "computer says no" and denies the connection.
Sure, we'll find workarounds, but for 99% of people, that "invisible border" is a brick wall.