de0u:
These all pertinent questions and I did talk about this briefly, including that it seems to go against the the new Digital Markets Act in EU, however I didn't press on the issue because I was talking to the developers, and not the decision makers who are imposing those requirements on the team. Many of those decisions are done above their pay grade. But they said that the config for this was deliberately put server-side, so if business requirements change then they can tweak the rules more or less instantly without requiring an app update.
To understand decisions like this, we have to understand the mindset of an organization such as a bank. They are not tech companies and don't want to get involved with any of this. IT is a cost. By simply "outsourcing" the vetting of apps to the Play Store, they can say they have done enough due diligence and at the same time block the vast majority of malware. If they allow other things, not only they have more work because they need now to vet apps and/or stores, they open themselves to more potential liability. That is how they think. The incentive is to minimize effort and/or liability to the bank. Any collateral damage is not a factor to them by default.
I'm not defending it, by the way, just saying how I see the incentives playing up to cause these outcomes.