What is meant by a genuine Apple device -> that means the device has a certificate signed by a CA that chains up to Apple's App Attest Root CA.
The appId is stored in your certificate and in each assertion. Super user can modify app id all he wants, he can't modify it in the certificate where Apple put it in on their (Apple's) servers.
can a user use the AppAttest API without going through my application, in order to produce false certificates for example - the premise is that Apple keeps their Root CA private keys secure. If those were ever to be compromised then the answer would be yes. However, if that were to happen there would be much bigger issues all up.
Regarding assertion formation for requests, let's imagine that the user does not have a login -> if the user does not have a login, don't generate said assertion? it's pretty simple.
Is there any way to block a device that is suspected of having fraudulent activity -> that implementation detail is entirely up to your application code.