Plus the whole "banks need to protect you by ensuring your device" is stupid when cards are protected only by a PIN, and the app also requires some form of biometry to unlock it, which is to encrypt the underlying tokens. Banks should protect your money on their end, with clients having their responsibility to keep safe their stuff, whether that's their card or phone. It's a stupid premise itself, and it's lazy engineering.