After another month of waiting for response (mBank has 30 days to respond to my complaints, so naturally they respond after 29 days) I finally understand why they block mBank PL app on GrapheneOS.

They genuinely think, that "rooted Android" means "any alternative Android ROM". So even despite GrapheneOS not granting user root permissions (so not "rooting" the device), they still consider it "rooted".

It all makes sense now! (it doesn't)