You were the one that brought up payments though. Nobody else specified. They just said it could be hacked, which you seem to agree with.
> which are like you said handled
Also, I corrected your misstatement about payments. They have absolutely nothing to do with decomp, and certainly can't be used to dismiss the entire attack surface of a mobile banking app. Your example is complete nonsense.
You are really digging a hole here.