Custom attributes are returned:

Request

GET https://graph.windows.net/mytenant.onmicrosoft.com/users/8b2ceb5d-4f45-4e42-b979-419119df4eaf?api-version=1.6

Response

{
      "odata.type": "Microsoft.DirectoryServices.User",
      "objectType": "User",
      "objectId": "8b2ceb5d-4f45-4e42-b979-419119df4eaf",
      ...
      "userType": "Member",
      "extension_5c5668a4ddb44c27b0d55cb412c41787_loyaltyId": "some value from the demo"
}

Source: this is from the sample app: B2C-GraphAPI-DotNet

Lookup Extension Guid via the Azure Portal

The above is for builtin in policies.