It seems fine now. Not sure what Google did, but for a few days, CTS profile was false and PlayStore not certified. But today when I checked Magisk, it passed SafetyNet without any mods whatsoever. My PlayStore was still showing not certified, so I cleared cache followed by data (in that order) of the PlayStore app and voila! PlayStore is certified.
I am not sure for how long this will be the case. If Google moves forward with hardware key check, then we'll have issues with unlocked bootloaders in the future. But for now, as of writing this (March 13, 2020), it works without any need of mods.
Cheers!