Some ~4 years ago i had the iOS app. It would open without touchid or a passcode. It would execute transfers without a PIN or biometrics.

Leaving your phone unlocked basically meant someone could drain your account.

I reported it, zero response. Bunq, not even once.