The idea here is that SolarWinds itself would have used it to verify that their TeamCity instance is in fact running unmodified TeamCity with configs that track

The idea here is that SolarWinds itself would have used it to verify that their TeamCity instance is in fact running unmodified TeamCity with configs that track back to versioned files. They could then provide a static proof of that to their customers, who then build them into their own chains of attestation. Yes, if all you need to do is an SSRF on some intermediary server to pivot to some other server, it doesn't help ... unless the target server is also being attested and regularly rebooted back into a clean state. It's all just bricks in the wall, at the end.