Apps check if Google says this device is stock and original. Booting alternative OSes is allowed but frowned upon. And of course doesn't get a Google approval signature. Something like that. Basically programmers not wanting to make the checking themselves and relying on Google to tell them what devices are "secure".

idk, maybe the app wants to check if it runs on normal phone hardware, not some reverse engineering virtualization? Or something like: if the OS is verified and unrooted, no secrets get out?

Funny thing is I can use banking grapheneOS phone and the main Health insurance app, but not the Health Insurance TeleDoc-App. Personally I think apps that need GSM or at least be officially google boot verified are apps made by lazy morons, but that's just a guess.

Quite a comfortable way to do this is with grapheneOS. That really gives you a choice. Can't say much about each and every app, how they run. Although most of my usage hasn't changed much with grapheneOS as I changed from gsm-free custom ROMs. Works quite good with a nextcloud.

Afaik this is possible, but the banking apps don't like rooting either. No achievement there.

The butter really has a tray, yes. But in the fridge it sits in the dark even more, for all it sees is the ceramic lid on top.