No, you don't.
>For example users by default aren't even allowed to access app's "private" data.
Which is already what Android's security model specifies. It means that other apps or other people using your phone won't be able to steal data like your 2FA app's private key.
>Those apps want to make sure that the user isn't in control of their devices, they want to make sure Google or a "trusted party" is.
Their app may benefit, or even rely on the android security model. Unverified devices have the possibility of having that security model broken.
>If Google really wanted to prove security with SafetyNet they would stop attesting devices that haven't been updated
I agree, but there is a trade off where you will cut out old devices. This is why at first Google lets app developers choose if they want to avoid devices that can just be spoofed.