After decades of IT work, I don’t trust users either, but I especially not competent users. If I were designing a device to store financial data and passwords, I would explicitly block them from hacking it without wiping it first; if they want to root it, they can backup and restore their data, and when-not-if their disabling of security protections results in theft and loss, that’s their problem and not mine.