(3) is by far the most important, but I can’t see how it will get attention from legislators or regulators.

Also, even if it happens, how could we ensure that service providers (say a bank) don’t start enforcing hardware based attestation?

We’d either need non-attested devices to be common enough for them not to bother blocking them (we are here now), or explicitly protect the right to software freedom. Maybe as part of a more general right-to-repair?