Your linked sources [1] and [2] don't really cover that topic. They mainly cover the use of Android apps and highlight the danger that the Android devices might be hacked, recommending use of dedicated devices. From [2]:
> Last but not least, please note that the photoTAN procedure is not only available as a smartphone app but also as dedicated hardware (Cronto, 2011). Naturally, our statements about the security features of app-based authentication cannot be transferred to thephotoTAN hardware device. Quite the contrary, a dedicated photoTAN device — available for all three analyzed banks — offers excellent security properties largely similar to those of chipTAN.
But this wasn't your point. It might very well be that the transaction data is not verified by the generator devices and only displayed, but your sources don't state it.
Actually, this statement is not true, as those transactions and their payloads are not cryptographically signed and neither are they verified anyhow [1] [2]. Attackers or malicious activities on Android can easily modify the payload and still have a valid transaction for the end-user; showing up the wrong IBAN, wrong amount and wrong recipient. This applies to both the official banking apps and the photoTAN generator devices that Cronto is (re-)selling.
Note that the research was made public and reposted/printed in a _lot_ of newspapers in 2016. And of course, nothing got improved.
If you search the web for Uni Erlangen (FAU) and the "crypto" analysis, you'll find out that Cronto / CrontoSign is the software supplier for pretty much every major bank.
And yes, it's patented, and yes, other frameworks got taken down on GitHub for copyright infringements when they tried to reverse engineer it.
The only open implementation of the HBCI 2.2 / FinTS 3 [3] standard that I personally know of that hasn't been taken down already is libfintx [4].
[1] (German) https://www.fau.de/2016/10/header/phototan-banking-nicht-sic...
[2] https://faui1-files.cs.fau.de/filepool/projects/matrix-code/...
[3] https://www.hbci-zka.de/
[4] https://github.com/mrklintscher/libfintx