Google is the one reassuring them that this way their banking app won't be tampered with by anyone. It's how they convinced them to trust the Google/Apple in the first place. That's why they moved away from physical tokens and the like, because the trusted agent is now Google. I'd rather go back to tokens and a webpage I could use from the phone, TBH, but that's almost a non starter these days.