The Fiat-Shamir heuristic is assumed to substitute public-coin messages from the verifier by hashes of the prover's messages until this point, i.e.: $$H(\alpha_1) = \beta_1, \\ H(\alpha_1, \alpha_2) = \beta_2,\\H(\alpha_1, \alpha_2, \alpha_3) = \beta_3,\\\vdots$$ where the $\alpha_i$'s are the prover's messages.
I understand why the Fiat-Shamir heuristic is proven to be secure in the ROM, however, in practise, the hash function $H$ is NOT an oracle, so what avoids the prover to grind over his messages to be able to forge a fake proof?
For instance, in a $\Sigma$-protocol there is only one message from the verifier $\beta_1 = H(\alpha_1)$. What if the prover grinds over some $\alpha_1'$ until he finds some input to the hash function such that $\beta_1$ lets him to obtain some advantage?
Why do we hash ALL the previous prover's messages to obtain the next non-interactive verifier message? Which is the problem of performing, for instance, $H(\alpha_i) = \beta_i$? Even worse, what if the prover can hash anything that he wants?