browsers are not a market in themselves, browsers are used to browse the internet. they are irrelevant without the context around it.

Google's Chrome used to be only about 60% compliant with W3C guidelines. They still became the de-facto default browser and so the guidelines changed to better match Chrome's interpretation.

if google or cloudflare decide to create some bullshit attestation system to lock alternatives out and vendors adopt it,

It's already happened when Microsoft released the first version of Edge. Google killed it by making it "incompatible" with its services.

and they seem to be scoping out how to do just that.

Cloudflare? By giving money to a project aiming at breaking up the duopoly...?