Holdout sounds like it is explicitly added to ward off any criticisms insinuating DRM. If a server is not denying access for clients with no valid attestation

Holdout sounds like it is explicitly added to ward off any criticisms insinuating DRM. If a server is not denying access for clients with no valid attestation then what exactly are the servers gaining from implementing WEI? CAPTCHAs also reasonably prove that the user is a human and legitimate but not all captcha challenges are solveable by humans in one go. Businesses have denied access for those failures and they just repeat the challenge until the captcha is solved successfully. If the failures are less per client they can easily be treated as tradeoff against security. What's stopping websites from doing the same with WEI? They can always deny access and repeatedly request attestation until a positive reply comes. This is acceptable for those "attested" clients where the failures are random and within an upper bound. But a client without attestation can always be denied or they can be shown different limited content altogether. In both the cases the unapproved clients are at a disadvantage.