This is of course the answer to why they're doing it: banks have no interest in making power users' lives harder, they just care about lining their pockets like every other business.

But we do have to wonder if the upsides outweigh the downsides. Someone surreptitiously stealing and replacing a smartphone to install malware on it can happen, but will that ever be common? Someone could also surreptitiously install malware on a laptop, but I don't hear of that happening a lot. I don't know of any banking trojan that is typically installed via physical access.

Do we want a world where people have no real ownership over their device anymore for this attack vector that has existed since day one but is rarely abused in the sort of attack that we're trying to prevent, or do we prefer a maker community to be able to exist? For example, F-Droid could not exist without Android allowing people to install software without needing Google's approval. A large part of the open source Android software is there and it's already fairly small due to the limitations that Android already put in place (F-Droid is large enough that I can replace nearly any apps with an open source alternative, but it's nothing like the community behind a Linux distribution).

It's also not just banks. Indeed, banks might not care about restricting users other than as a means to minimize risk, but Google certainly has an advantage if everything has to go through them. And I understand the developers agreeing to code it up: they're not evil people, they are themselves and they know they and their colleagues aren't evil. Of course they would allow any reasonable app in the app/play/whatever store and people can enjoy the platform without worry. I see their perspective, but there's a bit more to it than that ideal.