Not to mention that the options outside iOS and Android are slim and for the most part bad (or atleast simply even worse than those).
Because to me it sounds like a cat and mouse game that Google and banking apps are destined to lose.
The strongest levels require hardware key attestation (which, in my understanding, uses a certificate that's baked in secure hardware and signed by Google): - https://grapheneos.org/articles/attestation-compatibility-gu... - https://developer.android.com/privacy-and-security/security-...
Unless you know how to build a sandbox that can simulate a TPM with a key inside that only Google knows. Or something like that. I'm not an expert but there's plenty of information on the internet about this. It's definitely more than "the sandbox is buggy".