Answer
A service update can introduce new functionality on an existing projection that isn't automatically covered by an existing Full or Read-Only grant, which silently downgrades that projection/role combination's effective grant level to Custom. To find and fix these in bulk, query FND_PROJECTION_GRANT joined through FND_PROJECTION_GRANT_API.GET_GRANT_ACCESS() for rows where the access level is CUSTOM, then for roles following a naming convention like _FULL or _READ, re-apply the intended grant explicitly with FND_PROJECTION_GRANT_API.GRANT_ALL() or GRANT_QUERY() respectively — running this as a script after an upgrade restores the previously-intended Full/Read-Only access instead of leaving affected projection/role pairs stuck on the more restrictive Custom level.