I don't agree that your example makes sense. Don't feel like writing a wall of text. Zero justification for a locked down system.
> which are like you said handled
Also, I corrected your misstatement about payments. They have absolutely nothing to do with decomp, and certainly can't be used to dismiss the entire attack surface of a mobile banking app. Your example is complete nonsense.
You are really digging a hole here.