> The Rabobank app works fine on Android phones that haven't seen updates in years...
Exactly. If these companies were so serious about security, they should also block devices with, let's say, >1 year of security updates backlog. But that's a completely different number of customers compared to negligible Graphene/Lineage/e userbases.
It's not about your security nor your account. They are protecting their app, their apis, their servers. Everything that makes the life more complicated for hackers will be deployed, even if that includes power-users hacking their own stuff.
That would be on Google. If Google says the phone with zero updates for 5 years passes system integrity, then who we are to argue
They do not block unupdated phones because that will force users to buy exceptionally expensive devices to keep updated. Another thing is actually supportability. Just like any enterprise software, it targets a set of common devices so they can provide support and QA on it.
Now, that isn't to say there aren't security issues, nor that QA is perfect on devices they do support (like with any enterprise software projects), but it is a valid reason from a business perspective to not support everything.
Why do you think generally OpenBSD and such platforms aren't supported by commercial software, nor most open-source software? It adds a lot of burden for testing and QA on developers who will need to become intricately familiar with yet another platform.
People stare blindly at some customer support answers and hinge everything on those words, but if you think carefully about how software, compatibility and support work, this all makes perfect sense.