> To maintain that level of quality, we also need to be clear about our system requirements and avoid dedicating resources to troubleshooting issues on unsupported platforms and configurations.

This is such a corporate non-answer. If that was the problem, they could just detect the custom ROM and when someone calls support, the support agent could just say sorry not supported and hang up. I doubt that is the real issue.

One troubling possibility is that some security might be implemented client-side. Banks are ahead in security in some areas but far behind in others. Like in some cases you can just take money out of someones account if you know their account number, they rely on manual fraud detection, heuristics, and chargebacks. Instead of standard 2FA, my countries banks use a baroque parallel system. My password was for many years a word like "toast": It had a maximum length, had to be pronounceable over the telephone, was case insensitive etc.. Third party payment providers don't use something like OAuth but directly ask for my bank's password, and they used to just scrape the bank site, and so on.

But I think the real reason is regulatory, political, or due to pressure from the platforms. There is no pressing business or technical reason to go out of their way to block custom ROMs.