The concern is more to do with other apps reading the Barclays app's private data on the phone, which is possible if the other app has root permissions. Without root permissions, the Barclays app data is safe and only readable by itself. In its app data, it is storing some sort of token that can be used to perform actions as the user, and it's only protected by a 5-digit PIN. So, if other apps were able to extract this data, they could brute-force the PIN offline and gain access to the user's account.