Need to confirm the leak but this solution opens up "start roll and immediately disband for guaranteed loot" exploits

Yes, it would. However, I don't believe (guessing) this would make any difference between this or disbanding the group right before kill. Actually, I'm not sure how this was handled on retail, but it seems to be the most rational thing to do - distribute the loot among participants and consider the rest as if they passed.

Does disband happen only when everyone leaves ? Otherwise maybe don't allow to disband manually if there is a roll going on ?

not blizzlike, on retail people can leave while a roll is on.

Leak Sanitizer report

Indirect leak of 120 byte(s) in 1 object(s) allocated from:
#0 0xcd7c00 in operator new(unsigned long) (/home/jackpoz/trinity/bin/worldserver+0xcd7c00)
#1 0x2858795 in Group::GroupLoot(Loot*, WorldObject*) /home/jackpoz/trinity/sources/src/server/game/Groups/Group.cpp:991:23
#2 0x2357d43 in Player::SendLoot(ObjectGuid, LootType) /home/jackpoz/trinity/sources/src/server/game/Entities/Player/Player.cpp:8658:36
#3 0x298052b in WorldSession::HandleLootOpcode(WorldPacket&) /home/jackpoz/trinity/sources/src/server/game/Handlers/LootHandler.cpp:231:18
#4 0x2d2e77f in WorldSession::Update(unsigned int, PacketFilter&) /home/jackpoz/trinity/sources/src/server/game/Server/WorldSession.cpp:311:35
#5 0x32f1c11 in World::UpdateSessions(unsigned int) /home/jackpoz/trinity/sources/src/server/game/World/World.cpp:2987:24
#6 0x32ec3f0 in World::Update(unsigned int) /home/jackpoz/trinity/sources/src/server/game/World/World.cpp:2329:5
#7 0xcefd0c in WorldUpdateLoop() /home/jackpoz/trinity/sources/src/server/worldserver/Main.cpp:429:17
#8 0xcdfa1a in main /home/jackpoz/trinity/sources/src/server/worldserver/Main.cpp:334:5
#9 0x7f701da7709a in __libc_start_main /build/glibc-B9XfQf/glibc-2.28/csu/../csu/libc-start.c:308:16

what about removing the line "RollId.clear();" and letting ~Group() delete the roll ? Until the loot is distributed blizzlike

f04e90f fixes the memory leak, blizzlike behavior still needs to be implemented properly though

maybe those rolls could be put in a worldwide container and updated every loop ?

sound like the best approach