Only fragile ones, and those will only work until google finally flips the switch and their servers stop validating anything less than true hardware-backed attestation.
It's about as easy as it would be for an ISP to inject code into an HTTPS page.
The only reason anything works is because Google attestation servers still return a green light for evaluationType=BASIC. Once old devices become rare enough they'll only return a positive attestation for evaluationType=HARDWARE_BACKED.
Go find try and find a single instance of anyone achieving HARDWARE_BACKED with less than a fully stock device.
They are none. No amount of Magisk magic will make it work because it's all taken out of software's hands. Bypasses at that point look like electron microscopes and micro-electronics cleanrooms.