No, they’re absolutely not. Check out tricky store to see how we’re faking a trusted environment on custom and rooted roms. You can pass new device integrity with a valid unrevoked keybox on A13+ and new strong on <A12.

It’s a new stage in the arms race for sure but it’s still possible to bypass until all of the keys used to sign keyboxes are revoked.