Play Attestation is a Google hosted database of build keys/hashes for known Android builds. Android-side of this attestation is an API which calculates and returns those hashes to the app.
There's nothing preventing the app from verifying the build itself against its own database. So they can allowlist GrapheneOS builds if they want - but of course that means that all other ROMs are still banned.
Are the bank apps trusting graphene keys or google them self? Isn't play attestation completely in the hands of google.