Agreed.

And what’s particularly galling about this is that it’s never made any sense to me. Are you telling me an Android app, on compromised hardware or otherwise, could send malformed data that would for instance deposit $1M into my bank account? That doesn’t sound like an issue of local security. An app is just a frontend, all validation would still be through the banking infrastructure.