There are many reasons why a "payment security check" can fail, even if smartphone is licensed and has passed Google's SafetyNet test.
Sometimes there are crude heuristics in payment/gaming apps. PokemonGo is such an example. Those apps often produce false positive error messages. An unwanted "blacklisted" app (eg. SuperSu) on device or a file/folder with "forbidden" name like *Magisk* is sufficient to trigger security alarms. Nobody knows what's really going on in these nervous apps and they doesn't show anything what's wrong with device to protect their detection methods.