This is already happening. It would be nice to have a purpose-built "clean"/”lame" device that not only did networking for you, but let you run whatever super special shit that garbage banking app needs attestation for while serving it over vnc or similar to your "dirty"/"cool" device. Then the lame device could be quite small, maybe even stuck on to the cool device as a dongle something.