That's the world we are in. Operating systems in modern computers are pretty much just sandboxed apps being run by the firmware.
On lower end phones, it is already common to have the OS that the firmware runs be a realtime hypervisor that multiplexes Android with a higher priority realtime OS to help drive the radio.
> device attestation and the power that gives them (and Governments) to control what your computer can and cannot do.
Device attastation is probably the least scary form of this. You still get to run whatever software you want; all you lose out on is the ability to interact with external services that demand attestation. This is a much more pro-consumer way of implementing DRM than actually locking down computers, which looked to be the way the industry was heading for years.