We've had NFC, banking, etc on rooted phones and even on windows desktops loaded with malware for decades now. Clearly there's a tradeoff that can be made here and the banks still find it worthwhile to offer the extra features and save money on staff even if it occasionally causes fraud.