Because the GrapheneOS team takes security seriously, and spoofing would actually justify banning.

From https://grapheneos.org/articles/attestation-compatibility-gu...:

> GrapheneOS not only upholds the app security model but substantially reinforces it, so it cannot be justified with reasoning based on security, anti-fraud, etc.