The threat is copied clients
Once an app ships, API endpoints can be inspected, replayed, scripted, and hit from non-app environments unless the server asks for stronger proof.
Attestation belongs near the edge
Validating device authenticity before expensive backend work can reduce waste and keep abuse controls closer to traffic.
It complements, not replaces, auth
App Attest is one layer. Products still need user auth, rate limits, replay protections, logging, and thoughtful failure handling.