Depends on what country you're in. In the UK, the banks are often held liable for various scams that involve the transfer of money, so they up the security over and over again. A bank will rightly argue why it's responsible for an old granny sending her life savings to her new lover in Namibia, so it seeks to block that transaction in the first place.
Some of that liability is fair but most of it is the government telling the banks to account for the loss when someone is scammed. They are obviously going to mitigate that as much as they can.
> so they up the security
They're upping the surveillance, not the security, quite demonstrably.
This is meant to protect /them/ from liability and not /you/ from loss.
Rooted devices don't enable that transaction. That's all social engineering.