[0]: https://github.com/cyberjunky/python-garminconnectFor now its just tls fingerprinting, not client attestation - so, I managed to implement a working solution. But I am sure they will tighten the screws still further.
The only annoyance is that Garmin requires 2FA if you enable the ECG feature on your smart watch/fitness tracker, but I have a small program that reads the 2FA codes from my Gmail inbox and supplies them to the scraper without too much trouble.
I have the impression there are permissions and APIs to access sensor history and activity records, but I haven't had a need to dig in and learn what restrictions there might be...