That's great, but that doesn't actually guarantee that this new feature requires that the phone is using the hardware security module, just that you'd be able to prove if it it was.

Don't get me wrong, it's still better than TOTP in many ways, but having the actual security coprocessor is a big distinction.

There is no practical difference. For people who need the security, this API can guarantee it.