I work for a bank. This is why we ship our own 2FA app.
Banks can and will do everything wrong.
* https://reports.exodus-privacy.eu.org/en/reports/fr.creditag...
* https://reports.exodus-privacy.eu.org/en/reports/fr.lcl.andr...
* https://reports.exodus-privacy.eu.org/en/reports/com.caissee...
* https://reports.exodus-privacy.eu.org/en/reports/fr.banquepo...
* https://reports.exodus-privacy.eu.org/en/reports/com.fullsix...
In my country, banks used to mandate use of a "security module". I decided to see what this thing was doing and caught it intercepting every single network connection.
Do you supply source and repeatable build info?
Aside from almost certainly being closed-source it was probably developed by the cheapest off-shore bidder for the project. But who knows? That's the point. They won't tell you anything because they "take security very seriously."