The reasoning goes like that. App is more secure than web because 1. you can share a password but can't share the shared secret generated when the app is bound to account (lol, yes, they believe so) and 2. It has certificate pinning so you can't be mitmed when the system trust store is manipulated

The app however is only secure as long as your system isn't rooted. To make sure it isn't rooted you need to ask somebody who signed the system image if the integrity still holds.

I heard interesting ideas about phones, such as all phones having secure enclave and hsm which the app is totally using, so you can't just lift both the encrypted secret and it's kek from the same filesystem