I think this would all be possible without a TPM and those instances where my bank needs to verify my device is complete security theatre that negatively affects me and my systems.

My password manager feels quite happy without it, some futile regulation might require my stupid bank to check for TPM, but I do anything to not let it get near a PC.

With some TPM spoofing none of the features can work and the average security researcher can probably quickly confirm this.

TPM might be the wrong medicine if some bots down there even praise it as something advantageous.