They don't block Graphene directly, they block any phone that doesn't have attestation, which the Graphene phone cannot have. https://grapheneos.org/usage#banking-apps

Basically, GrapheneOS on a phone counts as a "tampered" device.

GOS offers it's own attestation. They just fail to include it.

You're right that I worded my comment wrongly. More precisely, GrapheneOS doesn't and cannot have the most convenient, most widespread, Google-backed tamper protection, which developers use because it's convenient, and often the easiest way to gain some authority, compliance, or just a badge of security.