Thanks for all the replies. Your thoughts on this also tend to go in different directions.
As so many replied I want to clarify the terms for using the bank identification app. Below they are (G)-translated into english;
Undertakings to protect BankID BankID may only be used by the customer and shall be stored in a safe manner and under supervision, taking into account the circumstances. It shall be handled in the same way as money and other valuable documents. The customer shall take the necessary measures to protect himself against unauthorized use of BankID. For example, a mobile device, computer, card with BankID or notes on codes may not be left unattended in a hotel room, other temporary accommodation or in a vehicle, bag, jacket pocket or similar that is not under supervision. If the mobile device has a biometric function (for example, fingerprint reading) for identification and/or signing, the customer may only activate the biometric function on a device that is used exclusively by the customer himself. The customer may not use the biometric function in a mobile device where another user has downloaded his mobile BankID or registered his biometric data. If the customer suspects that BankID has been used without authorization, the customer must block BankID in accordance with section 8.1 and file a police report. The customer undertakes to: • Choose codes/passwords with care that are difficult for others to reveal. The chosen code must therefore have no connection with the customer's personal identification number, card number, telephone number or the like,
• If the customer needs to write down or store a code, do so in such a way that no one can understand that the note relates to a code for BankID,
• Do not reveal the code/password to anyone,
• Do not write down the code on, in, or near a mobile device, computer, card with BankID or other equipment used for communication with the bank,
• Keep the document with the PUK code for the card received from the bank in a safe manner,
• Destroy the document with the PIN code for the card received from the bank,
• Change the code immediately if the customer suspects that someone has been able to access it,
• Delete BankID that has been downloaded and stored in an unprotected location
(for example, a public computer or a borrowed mobile device),
• Do not transfer/expose BankID on unprotected media or through unprotected communication (for example, by e-mail),
• Only use software approved by the bank when confirming identity and signing using BankID,
• Use available security devices, such as the mobile device's lock code,
• Immediately turn off the biometric function if the mobile device can or is to be used by a person other than the customer for identification and/or signing and
• Immediately request blocking of BankID if there is the slightest suspicion that someone else has become aware of your security information (password, codes or biometric data).
If the customer fails to comply with any of the above obligations,
there is a risk that an unauthorized person will identify themselves as the customer or
use the customer's BankID for signing.
The things I wrote in my original post regarding "not rooting the device" etc. I took from the "security and recommendations", and is not in the actual terms that you'll have to accept when applying. The only point in this text that I feel could be risky is "• Only use software approved by the bank when confirming identity and signing using BankID", but I guess they are talking about the bankID app intself, as the bank does not provide a list of accepted OS:es / devices etc.).