Whatsapp and Signal are fine. Random banking apps suck because their myopic and incompetent policies around custom OSes. Especially here in Germany where banks and even tech company management see internet as a magic, totally untrustworthy new curiosity. Combined with the overall extreme risk-averse society, basically none of the bank apps from big banks work with custom OSes. All require various levels of "hacking".
They use Google SafetyNet as a security guarantee and some outright ban access while letting you use a completely custom Linux PC. There are ways to hack those API calls with various system level interceptors like Magisk. I keep a custom made 2FA code generator from my bank as a backup though.
Anecdote: I develop an app for a bank at my job in Germany and I was forced to implement root detection because of some annoying pentest. Everyone agreed that it was just security theater + checkbox compliance but it "had to be done"...
I think detecting root and displaying a warning about risk is okay. N26 does it, so does Scalable Capital.
However Sparkassen, Deutsche Bank etc all refuse to work on Lineage OS at all *without any actual root solution installed*. I actually don't want any root access, I can use recovery mode and even write special permission XMLs if certain apps need it.
I just don't want bundled Google Dialer etc in stock ROMs that is feeding more data to Google about me and my loved ones. I keep my and my family's contacts in a private cloud solution. I don't use GMail for private e-mails. Nor Google Calendar. Removing these apps break stock ROMs due to special permission modifications Google did. Lineage OS is my escape but the stupid banks reliably choose stupidest security theather solutions that you were forced to implement.
Even the apps that work for online banking, you can't use them for digital payments anymore. The old integrations worked fine but with Google Wallet even GrapheneOS isn't good enough
Weirdly Commerzbank Banking App rejects logins approved by a rooted phone so I cannot login with my LOS phone. Comdirect is literally the same company but a purely online product. It is so stupid. I also use INGDirekt and it works.
They use Google SafetyNet as a security guarantee and some outright ban access while letting you use a completely custom Linux PC. There are ways to hack those API calls with various system level interceptors like Magisk. I keep a custom made 2FA code generator from my bank as a backup though.