Comment by megous

Optionally. And passkeys attestation only covers the HW key for example, not the OS running the website or the website. You're still completely free to re-implement it your way + FIDO2 is a standard, so eg. if you want to write your own native app for the bank web API, or whatever else, you can and passkey attestation will not stop you.

Android app/os attestation on the other side is a complete lockdown that prevents you from creating your own apps on top of server side apis the original mobile apps use.