Bank apps in India don't run on rooted phones, need developer mode and adb disabled. At the same time, their website works fine on Firefox on Linux where I can literally go through all their front-end source, attach and run debuggers.

What even is going on? Why are banks doing this security theatre when all their apps are doing is calling some backend apis?