How can they be sure the user with the rooted phone is Very Good At Security and rooted their phone on purpose instead of someone who got their phone hacked and has spyware listening to their banking logins?

The safe bet for banks is to deny all banking on rooted phones, that way they don't need to argue about lost money, they can just go "phone rooted, not our problem, we did our best to prevent it".

It should scream the people that phone is rooted. But, denying services is inimical.

Its not just banking app I have started to see a lot of app behaving differently when phone is rooted. Rooting generally means people can mitm app, which app developer obviously doesn't like. Its more about control than security in my opinion.