The apps now require the use of "Security Assertion" from the client.

In this case, it's by Play Protect on Android, and whatever they use on iOS.

Client attestation might be more accurate?