Fortunately, this is not a readily accessible "score" to all apps and is (currently) only used by select apps as a boolean "passing SafetyNet" check. But Google

Fortunately, this is not a readily accessible "score" to all apps and is (currently) only used by select apps as a boolean "passing SafetyNet" check. But Google has been starting to take it seriously recently unlike before by using hardware attestation in TrustZone, so it's been a cat-and-mouse chase to find ways to fool it. It's gotten quite ugly, especially for older phones that are no longer supported by the manufacturer — I'm currently appending an invisible character to the phone model name and faking an old security patch level to pass it. As soon as they decide to enforce hardware attestation for all devices, it's over.