The last issue I had with safetynet a few weeks ago (pretty rare for me), was Google updating it to require the ROM security patch level/date to match the date the fingerprint of the ROM. I'm not sure if they reverted that though. I used a magisk script to change build.prop to fix that. You can use Didgeridoohan's magisk module to do that too. That might be one reason safetynet would fail (if it's always been working) that I can think of.
Here are the details of you're interested.
https://forum.xda-developers.com/one...5/post78433987