I think I found the answer myself.

For groupBy + aggregate: If you aggregate Entity E by some grouping key, the order of E-Records with a given E-Key are only interesting for the resulting aggregates within the partition of the grouping key, so the problem does not arise.

For the foreign key join, the answer can be found here:

https://www.confluent.io/blog/data-enrichment-with-kafka-streams-foreign-key-joins/#race-conditions

The short version is: When sending messages with a partitioning different from the original one, a hash of the original record is added to this message. In the end, this hash is used to determine, whether a certain message corresponds to the latest version of the original record.