I don’t blame them, they’re mitigating another potential risk. Malware that’s essentially a rootkit could send your bank login details to a malicious third party in realtime, for example. 2FA codes and all.
Also remember there are lots of people out there that aren’t as tech savvy as the HN readership. A random person that just wants some springboard tweaks or similar may not verify where these tweaks came from & not understand the consequences of installing essentially untrusted software.
This is 100x worse in browsers on desktops, where the percentage of people who install things like browser extensions or persistent malware is non-neglible. Yet banks largely accept that as OK, and if someone’s bank’s website decided to probe the filesystem for “evidence” of malware would 1. cause a huge scandal and 2. immediately cause malware to hide itself from the detection.
There are exactly zero reasons why a bank should be doing this and I would be quite pleased if Apple instituted rules against doing this kind of fingerprinting.