Does this mean the app is necessarily a trusted component here? What's to stop an adversary from reverse engineering the application, especially on a platform like Android where applications are side-loaded and binaries largely maintain source-level semantics?

I guess you could argue that, from the merchant's perspective, they just want to avoid being the easiest target.