[One (M7) Android Development] Cottaer:
I have somewhat success now. Here is, what I did:

* installed a test app for Safety Net called SafetyNet Playground from Playstore

--> at this stage, the test fails due to root and due to a firewall rule (it gets either a timeout with firewall on or fails due to root)

* switched off developer options in Settings (that is probably not necessary)

* switched off the firewall

--> I'm not sure, if the rules in iptables would be still active without root, so I switched it off before I lost root

* switched off root in SuperSu

* switching off root permanently in SuperSu

--> without switching root off before the last step would show the loader forever [MENTION=2895914]KyojinKun[/MENTION]

* rebooted the device

--> root was lost, the test app said: Android Pay would work now, so Pokemon should work too.

Now I went for the full thing:

* downloaded and moved to the phone from this thread [1] the following things: Magisk V6, Magisk Manager v1.2, phh's SuperUser 17 (Magisk Version)

* booted to recovery

* flashed Magisk V6

* flashed phh's SuperUser 17 (Magisk Version)

* rebooted the device

* installed Magisk Manager v1.2

* installed phh's SuperUser from Playstore

Now I can switch off and on root with the Magisk Manager, and when I switch off root and the firewall, I get an OK from the SafetyNet Playground test app, so Pokemon should work again, and, to make the story short (*), it does!

(*) Finally, when I updated Pokemon Go to version 0.37, I wanted to see that infamous screen just once. I tried with Firewall/with root just to see the screen once. With Firewall, the request did run into somewhat a timeout I guess and I couldn't log in. With Firewall disabled, but root, I got that infamous screen saying, my device wouldn't be compatible. Then I shut down root and restarted Pokemon, and it said, it couldn't connect to server. I waited for some minutes and tried again and again, but it alway said, it couldn't connect to the server (it still was working with the old version, before I updated). Then I tapped switch accounts, and it took me a screen, where I should choose between Google-Account or Pokemon-Trainer-Club-Account. I knew, I have both, since registering was such a pain the first days with servers not working for days, but played only with one of them. So I choosed the Google-Account and it was the other one, with me in this account having level 1. I found out how to switch accounts again, when not stuck on the loading screen, and tried Pokemon-Trainer-Club. But unfortunately it didn't remember the data of the other account and I don't remember username (which seems to be different from the name ingame) and password either. Finally it was a pain to get the user name displayed, but finally I could log in now and it works. Don't know, if they had a short outage on their server in this time or if it was a kind of a short ban after recognising, my device would be incompatible.

[1] http://xdaforums.com/android/software/mod-magisk-v1-universal-systemless-t3432382

PS: I want to add some information: I don't use xposed, so I don't know, if that involves some more steps. And I don't use the latest version of this ROM. It's probably almost a year old. Back that time I flashed so many versions and updates of Cyanogen Mod and they all were badly buggy, I finally was so happy to find a good working ROM I never touched (until today) this running system... So no guarantee, theses steps work on newer versions as well.