It requires a positive action from the application developer to include GrapheneOS's keys as well as Google's keys. So this is a deliberate positive step, rather than a default.
Only if they are using hardware key attestation. From what I've read elsewhere it looks like it was never broken so maybe they never went that far before.
Apps rarely use hardware key attestation directly but rather use it via the Play Integrity API. Play Integrity device and strong integrity levels ban using a non-Google-certified OS. Play Integrity uses hardware key attestation for both integrity levels and it's a hard requirement for strong integrity. Developers enforcing one of those integrity levels to use their service need to either stop doing it or add explicit support for non-Google-certified operating systems via key attestation. Roblox's documentation shows they're taking the latter approach.