No one explained it in any other comment (yet), so here is the idea: Google owns your bank's app signing key, which means that they can craft any update for yo

No one explained it in any other comment (yet), so here is the idea: Google owns your bank's app signing key, which means that they can craft any update for your banking app in a way that it makes it leak the content of your application data. In the case of a bank, this might contain sensitive information: but not necessarily the password / token that is used to access your account as this might be stored in a more secure place like the HW-backed keystore. Nevertheless, if they have a way to modify your banking app binary without you noticing - they technically have access to your bank account (to the same level the app has). Would Google ever do this? Probably not, but the risk of a key compromise by a rogue employee is still there. Is this risk higher than your bank leaking the key? It depends, hopefully the person who has access to Google HSMs is not the same that has the rights to create a new release on the Google Play Store. The biggest issue I personally see is that we're putting so much trust in Google to basically control all of your apps - but that's sort of already happening on Android because people are generally running Google-flavored Android builds which have privileged Google Play Services.