This seems like a weird policy, though. I can access my bank via a web browser on a desktop computer, which is certainly not even remotely a "pristine, locked-down platform".
Root exploits more common, but bootloader exploits aren't unknown. String them both together and you can remotely root a device, unlock the bootloader, install another OS, and relock the bootloader. All of this without removing apps or data; do it properly (custom recovery for flashing the new OS) and all the user knows is that the device wasn't working for a while (until they notice the giant new notification Google services puts up now, but some users don't even know what notifications are and either won't notice or will ignore it) https://github.com/segv11/boot-unlocker
Imagine manufacturers having the incentive to issue monthly security updates, else their users get very angry they can't watch Netflix/log into their bank app/use google pay...