Many people here are missing what the business model of banks is, they're in the business of creating absolute trust with their customers, as soon as that evaporates, the banks stops being viable. That means eliminating any (perceived) risk, whether real or not. From the banks perspective this move reduces the attach surface thereby reducing risk which is worth the tradeoff of an inconvenience to the 1% of people that would even care about this move.
How is GrapheneOS a bigger risk than a stock Android missing 3y of security updates?
Given that all these banks happily accept the latter, we can conclude that they do not actually perceive any of this as a real risk. Ergo, something else is going on (eg incompetence)