It's generally a known issue (users have to be aware of), that banking, payment and similar apps look for and detect unlocked Bootloaders, installed custom ROMs and treat those phones as insecure environments per their definitions
There are methods to spoof, but they require rooting (Magisk)...