Update:
After contacting support, who was useless, they escalated to the security team who was going to get in touch via e-mail. That never happened.
Contacted support again to ask for a follow-up, and they apparently can't or won't read the case history, and made me go through all the useless troubleshooting steps again. Then escalated to the security team who was going to get in touch via e-mail. I said that this is what was promised to me last time, but never happened. They said they would contact me this time.
Guess what happened: no contact. Reached support for the third time. Rinse and repeat.
I ended up never hearing from the security team, but I guess that somebody did something because without any change from my side, I was suddenly able to log in again.
Since I didn't really do anything in the meantime: didn't wipe storage, didn't change app version, didn't change GrapheneOS version, didn't change any settings, the only explanation I have is that something was done by Nubank. If the app is indeed checking Play Integrity, perhaps they have a way to whitelist devices and/or accounts at the server side.
Anyway... Here's my anecdote, in case another GOS user ends up having issues with Nubank.