> I think more like 5, although the government might start slowly, like only preventing non-TPM devices from accessing "sensitive" online services, e.g. banks or anything that requires a payment.

This has already happened for mobile banking apps on Android: Many of them already use SafetyNet with hardware attestation. The only reason not all of them do require hardware attestation is that not all of the older Android phones support that, which is exactly the situation Microsoft wants to change for TPM. And increasingly, other apps seem to be starting to use root detection and safety net for frivolous use cases such as McDonalds.