This is partially because it serves as a fingerprinting vector for authenticating users, and limits functionality (such as reusing the authenticator to access multiple accounts on the same site). This UX penalty will most likely dissuade people from limiting authenticators in cases where they aren't trying to meet AAL3 or rough equivalent.

Once you have an authenticator attestation, you can tie it to metadata on features, certification, and security incidents.

However, I actually don't suspect that real-world policy will rely on such dynamic metadata. Instead, organizations will limit the allowed authenticators to a static set of models, most likely models they issue to users.

So you'll see things such as banks allowing large money transfers only when you use the bank-issued authenticator, or having government contractors only able to authenticate into systems using the key fob they were issued.