More like bye bye Android Pay, didn't take much for the weakest link to break.
Even worse than their version that works with a hardware secure enclave is the version which works without one.
How does that one work? By ensuring that the user didn’t modify the OS image.
That’s literally all security there is.
It’d be a lot better if they’d just build a security model that doesn’t have to rely on the device being secure, but instead rely on the banks’ servers being secure.
I can thank some US banks that I, as German Android user, get locked down by Google. I get all the issues, none of the benefits.