And how exactly did attestation help there?

Securing apps from the user does not secure the user from malware.