On a 3700X you can just switch on the eTPM and it should work. Most bioses come with it off. And no Microsoft doesn't tell you this with a clear message.

But in my opinion this isn't really about security. It's more about DRM. Microsoft wants to appease the content providers by requiring TPM, supporting attestation etc.

This way they can support running Android apps (and other things like their own store thing they're still pushing) but keep the user from messing with them under the hood. The same way macOS does with iOS apps. If you turn off system integrity protection on Mac you will lose the ability to run iOS apps.