Google can turn Safetynet validation up or down w/o updating your Droid. Currently it is possible to bypass SafetyNet, but they did turn it up a notch lately, and if they require strong "Key Attention" then neither Magisk nor custom "rootless root" will work (and it will also mean that custom roms Will fail SafetyNet).

https://developer.android.com/training/articles/security-key...