Just to make it more clear, they only block you when you try to actually login to some service. I.e. they have no problem with you installing and running the app, unlocking and reading your id card. Then you can set the card's authentication and signing pin codes (which are written back to the card btw) and add the card to the app's wallet.
I might be wrong, but tf the device was compromised and this particular app was targeted, wouldn't it be a game over already, since the attacker likely had enough data to clone the card and use it somewhere else?