Actually they don't work because those apps suck. Typically the banks are responsible for preventing their own apps from working there. Because they don't care or because they follow some bullshit security-theatre policies, or because they just don't understand security, I don't know.

It's not Google that adds the code that makes your banking app fail: it's the goddamn bank itself.

But I agree with your point that the reason it sucks is not the AOSP-based system, and it's sad to blame the system when it's the app (or many times just Google) that is to blame.