It is fairly common for banking apps to include various "RASP" (runtime application self protection) tools/libraries which scan for various syndromes of attacks

It is fairly common for banking apps to include various "RASP" (runtime application self protection) tools/libraries which scan for various syndromes of attacks, including whether the phone is rooted, any screen overlay is active, a debugger is active or a dangerous app is installed (e.g. a SMS stealer). See e.g. https://www.ibm.com/products/trusteer-mobile-sdk https://www.ibm.com/products/trusteer-mobile-sdk