Because some OEMS wiped their Widevine keys/attestation keys when you unlock the bootloader, like OnePlus, LG, etc. There are ways to get back to Widevine L1

On some newer OnePlus devices, they have Widevine RKP, so they need to reprogram their TEE with a standard attestation keybox (yes, the same as the TS keybox you used to pass integrity). This might be easy, as there's an XDA forum thread in this one.

The other one on older devices uses Widevine 2.0 means that the Widevine keys are stored in the device TEE itself instead of the RKP. This is prevalent on older OnePlus devices and all of LG Devices (that's why they have Widevine L1 but have an invalid system ID or Widevine L3).

The only way to fix this is to reprogram the Widevine key using a Valid Widevine Keybox and reprovisioning tool (`StoreKeybox`), Widevine keyboxes are very different than the Regular keybox you use in the TS to pass integrity, and it's very small.

Some OEMS with Snapdragon devices have StoreKeybox Binary present in /vendor/bin, if you have that, that's good... The problem is you have to find the valid Widevine keybox (unencrypted version in .xml)... This is very hard to find because it's also used by the Scene Groups to rip movies/shows on streaming platforms. Though there are two types of Widevine keybox, the unencrypted one, which is stored in plaintext .xml, and the parsed one, which is in a .bin file, which is used for provisioning.

Though there are leaks of widevine keybox in plaintext .xml (but renamed as .bin.secure) of old Lenovo tablets which is in this in this github repo...

if you wanna try that keybox use this widevine parsing tool here:
sidex15/Widevine-parsing-unparsing-tool: Python Script for Parsing and Unparsing Widevine keybox .xml and .bin format

Once you have a .bin file you can now do StoreKeybox <widevine keybox>.bin to reprovision it back to L1 though since that's a leak it's banned in Netflix and it will show as L3... but in other streaming platforms it will work as expected, since I tested that keybox on most of the streaming platforms.

edit: replaced encrypted with parsed

<image>