This is a national security issue. A major corporation should not be able effectively impose a security ceiling by banning more secure operating systems (like GrapheneOS) due to it not making them money. Governments should pass regulations requiring any devices that meet certain security standards and support hardware attestation to be accepted by hardware attestation schemes. This will not pose an undue burden on businesses because you can easily add something like GrapheneOS to your scheme (https://grapheneos.org/articles/attestation-compatibility-guide), and even if it did, that doesn’t matter when national security is on the line.
Right now, it’s not as dire because you can still choose image or audio CAPTCHA, but I don’t know how long that will last, and getting the regulation out before the problem happens is better than after.