Has PayPal blocked GrapheneOS, or have they blocked every OS they're unable to verify and done a poor job of implementing their checks?

Hanlon's Razor is a useful tool. https://en.wikipedia.org/wiki/Hanlon%27s_razor

The very fact they've managed to convince anyone that checking what OS I decide to run on the devices I own to check my own banking is any of their concern is a problem in and of itself.

Ironically, I had to apply Hanlon’s Razor to the impolite tone of your post

You're a banking app. Why do you need to check my phone or my os? The security is not in what phone I use, but in how sane your 2-factor auth is and if even exists.

It is a useful tool, but is largely irrelevant to this issue. To the end user, this isn't really much of a difference. Whether the cause is malice or simply not choosing to use the smallest effective brush, they are still taking an action that is preventing legitimate users from accessing the service.

Hanlon's razor is for people. Organizations do not operate like people and do not deserve the same deference.

> have they blocked every OS they're unable to verify

This is evil in itself.

They have blocked rooted phones based on the error provided. Nothing to do with verification. They treat rooted phones to a level they don't with phones without critical security updates. That's the tension. Non-rooted phones aren't necessarily unsafer.