AMA: Device Health Attestation - security benefits and integrations

Hello, Since this explicitly mentions preboot, will there be support for bitlocker tpm and pin in intune? Microsoft's own recommendation is if an attacker has access to the device it should be protected in this way. The TPM attack can now be done in 15 minutes. How can device attestation prevent such an attack if it happens at a level it can't block? Personal data encryption is a possible fix here but even then it is not suitable for use right now as it's known issues prevent it being used in any real meaningful context in the enterprise.