[Xposed Framework Modules] CoinCoin88:
That's much, much clearer, thanks so much. What follows is a long answer to your questions/suggestions but, bottom line, I managed to sort things bout (maybe not the right way though?)

I've been running Magisk 27.0 with Zygisk, Shamiko, Systemless hosts and Play Integrity Fix. My device passes DEVICE_INTEGRITY, Wallet and contactless payment works like a charm. Magisk's denylist, although not enforced, contains basically all the apps that may detect root or altered environment (banking, streaming...). After unlocking my BL and flashing magisk, Widevine shows L1 in DRMInfo but my understanding is my OnePlus suffers the infamous flawed TEE implementation from some manufacturers, where SystemID changes after unlocking. And so, while Widevine shows L1, it's not actually valid and it reverts to L3 whenever enquired by apps.

- LSPosed 1.9.2 is running, along with HMA 3.2 (+ some other apps that I had from before e.g. disable flagsecure, YouTube adaway and another one for tweaking android auto). I also have BootloaderSpoofer enabled, which fixed issues with Netflix not starting and Prime video not streaming.

- I've followed the blacklisting approach as detailed on a github repo I linked in my previous post (linked in another tutorial thread for HMA). So, I have a template in which some apps are hidden (all those that I don't want possibly detected by other apps). I am then applying that template to all the apps I want to not find the ones from just before (banking, insurance, various streaming services...). Note that, I didn't have any issue with these before, but in my "Disney+ journey" triggered by a post above I decided to setup HMA all the way.

- Ruru says "all good" as attached (I had to add Ruru to Magisk's denylist so that it wouldn't find them)

With that setup, Disney+ would still refuse to stream : it starts, I can browse, and whenever I want to start a video, I'm greeted with a codeless error message, as attached.

Now, I fixed it : instead of using BootloaderSpoofer, I installed 2 additional magisk modules that I had initially tried but for which I wasn't fully satisfied regarding their benefit : a modded liboemcrypto disabler that works on OnePlus phones, as well as HuskyDG's Magic Mount Extend. I also disabled BootloaderSpoofer, consecutively, as it served the same purpose (*to me* : I understand it's not the same at all, but in my case it was for the same reason, i.e. streaming apps failing).

The only question that remains now, is why BootloaderSpoofer wasn't able to make Disney+ work, whereas liboemcrypto disabler was.

Edit : I think after turning my brain on I can actually answer myself! Liboemcrypto disabler effectively reverts Widevine to L3. Therefore, streaming apps don't have to deal with a "flawed L1" that spans from a broken TEE implementation. Whereas BootloaderSpoofer does something completely different, not affecting Widevine directly. My guess is it works with Netflix and Prime because these two apps can deal with a flawed L1, and restrict to SD after a L3 fallback. On the other hand, Disney+ just hangs at "broken L1, f*ck off", and needs a true L3 resulting from a disabled liboemcrypto.