I think they can use remote attestation on the mobile device to prove that it’s a physical device. They do that through Google Play Services or whatever the equivalent is on iOS. So, for instance, scanning the QR code on a custom ROM like lineage or GrapheneOS doesn’t work.