Great, so the no-name iPhone clone in China passes your test but EOS doesn't.
There's no way to assess the security of a rom from an app and it's about time that banks learn this reality.
Software on mobile is even more fragmented and less standardized than on desktop