Look to Minecraft servers like Hypixel for how anticheat should be done. You can completely hack your client, but your every movement is scrutinized by the server and only the data you need is received. This cripples what cheating can allow you to do without using client side anticheat and still enabling mods that improve quality of life.
I’m pretty sure my bank’s android app is just webview considering it has a cookie banner when starting it and it looks almost identical to the actual bank website. The biggest feature of the bank app is for 2FA, but it’s not like it’s much more convenient than SMS and they really should be supporting FIDO2 and TOTP codes for actually secure 2FA.