Motorola has to make dedicated hardware to support it.

Do they? Or just give gOS information under NDA?

Your bank does not need to use the app trackers to spy on you. They already know everything important there is about you.

What the banks are worried about is fraud. Fraud costs them money. But the thing is, the app development cycles are long and complicated, and instead of a pragmatic approach, they just bolt on more and more obscure non deterministic authentication schemes and heuristic checks. That's why the app wants to know things like your location and access to the list of other installed apps, and simple username and password are not enough to let you through anymore.

The device attestation for them is probably just another checkbox to tick on the list of "at least we tried". Regardles of whether it's actually relevant for security. As long as it saves them more money that it costs them, there's no reason to not enable it.

No bank gives a fuck about you. You are right but just for perspective, banks here use their app for 2fa with the only other option being sms (which doesn't even work half the time) and which bank you use is pretty much dictated by your employer. Banks aren't even that bad as some countries require an app for gov id which may or may not work on grapheneos.

This is a regulation problem, it's not going away. The most a user can do is keep a second phone with android just for verification. I really wish we could just move to yubikeys at this point.

bruh, most if not all banks in my country require a windows pc (with their rootkit "security software" installed) or a ("unmodified" ofc) android/ios phone sadly. simply using the website cleanly is not an option for many cases, in fact running one inside a secure android rom like graphene is actually one of the best solutions in this case.

The EU has standards for security and banks require you to use a phone, and the banks don't give a fuck about outliers.