The other angle to this is that going increasingly web/app based lets them shut down local branches. For my city the last permanent branch is closing soon so sh

The other angle to this is that going increasingly web/app based lets them shut down local branches. For my city the last permanent branch is closing soon so should I be locked out of an app the alternative would be the website which last I checked was designed for desktop browsing, or in-person service is a 6 mile journey to a 'mobile branch' available for 45 minutes a week. I'm currently using an old PixelExperience build which takes some efforts to hide it's unlocked/custom rom status (right now it passes basic but not strong attestation). What I really wonder about is while we don't have the software environment that the OS isn't tightly coupled to the handset (i.e. generic system images) where the optimums are for security if someone doesn't regularly upgrade phones to maintain support from the original manufacturer. The most recent official android for my phone is 8, I'm running 9, so that's at least 5 and a half years old. From a glance at XDA there's a collection of 11-14, however that brings up another issue of being able to establish trust in whoever is building your OS. Is an individual volunteer graciously building the latest version producing a recent version better than an older build from an established organization like lineage, or better than the ancient official build. Would my phone be seen as more secure by restoring older software and relocking. There's a number of factors in balance here I'd love to hear views on from someone involved in consumer bank app security, as much as they're able.