It's still possible to use XPrivacyLua (https://github.com/M66B/XPrivacyLua) with passing SafetyNet. It's a cat-and-mouse game, but the community is still ahead.
* Unless you get an Evil Maid attack [0], like adding a physical keylogger to the keyboard bus.
If the device is decrypted but on lock screen (like with TPM) there are more options, the main one is reading memory via DMA [1] on an ExpressCard slot (eg the wifi card). Also swapping out the memory to do a cold boot attack [2] is possible.
To make 4. useful, links with the domain different than the open one should not be allowed to be added to History, otherwise you can bypass it with a different domain.
And without 4. this new limitation could be bypassed with a redirect (from the same domain).