Custom domain without self hosting still requires you to use an email provider, could even be google. The only problem is if you self host and don’t rely on trusted proxies, at which point it depends on the reputation of the IP/Domain etc.

The way i understand it is that remote attestation (main point of this article) makes it possible for services to deny unapproved software. They can deny off market devices, operating systems, or certain password managers. So even if you use password managers you mentioned, if you’re using off market OS (e.x lineageos) they can deny access. Here’s a quote from the article “Remote attestation lets a website demand cryptographic proof that your device, operating system, firmware, and passkey manager are all on an approved list.”

It hurts to look at

*operating system