My suspicion is that these banking apps are running root detection code that look for the presence of certain other apps that signal "rootedness". The stated r

My suspicion is that these banking apps are running root detection code that look for the presence of certain other apps that signal "rootedness". The stated reason is always "we don't want malware being able to steal your account information". The non-stated reason is often "it makes our threat modeling easier if we can rely on the OS' defenses existing and working so we assumed. As a consequence of that assumption we are not entirely sure that what we are doing is safe from ordinary adversarial behavior on a device without these guardrails. So we don't want to run in such an environment and find out that our concerns were justified".