There has to be some fault laid on the people who installed this app too. If I download an Adobe AIR application that is suppose to tie to my bank accounts, and that app turns out to be a phishing app, who's fault is that?
When you download the Bank of America app, you click on the link on the Bank of America website and it goes directly to the Android App Market where I can download the application. That is all the vetting I need.
There is obviously going to be some issues with the Android App Market since it is completely open, but I would rather take the risk, vet claims myself and not be limited to the apps I am offered.