Yeah, compared to separate hardware HSMs mobile banking is a massive downgrade in both security as well as user being in control of the hardware they own (by forcing locked down closer source OS & forcing hardware updates).

If mobile banking really wanted to be secure, they would support something like a NFC yubikey for transaction verification. The fact they fully ignore separate secure HSMs tells you what you need to know about their security.