Because it's not about security, and bank doesn't own my device. If it was, I should be able to supply the bank my own attestation keys.