In this case, it only reduces the security of the app against exploits rather than the security of the OS. Secure spawning protects the app via unique ASLR bases, random memory tags, etc. Blocking dynamic code loading prevents common accidental vulnerabilities via insecure code loading and hardens against certain exploit techniques.

As with all things about security — it depends on your threat model.

It reduces security of the app itself, but doesn't affect security of the phone by much.

Not too surprising. I usually have to reduce my browser security on the rare occasion that I access PayPal via the web.