If using a phone, yes, but then you probably already did.

Of course not, since you can just install the Android app on your free software aftermarket OS. Surely banks wouldn't require hardware attestation or monitor your device for being rooted, would they? /s

Irony aside, yeah, this is a significant downside compared to hardware-based standards. Not so much for Android, as Google Pay and most competitors are implemented in software, but on a hypothetical iPhone or Garmin device running an open OS (don't laugh, it's a thought experiment), payment data security would be not much of a concern since all payment keys live in a secure and completely separate chip.