> Revolut is notrious in this regard. If memory serves, they explicitly check the build string for LineageOS and block the app if it matches. The workaround at the time was to build the ROM yourself with a new build name string.
What possesses companies to do things like this? A customer running a current version of LineageOS is going to have better security than running the out of date Android version that came with the phone. An attacker who wants root on something that will run the bank app doesn't have to use a different OS, they can just use any of this month's CVEs to root the "approved" version. Even requiring the latest patches -- which would exclude entirely too many actual customers' phones -- wouldn't stop attackers from controlling their own devices, because they could root the device before installing the patch and then install the patch for the vulnerability they used to get root on the device where they already have it.
And attackers who are going to modify the system to carry out an attack inherently have some kind of software development capacity, so measures like this have no effect on them and all they actually do is interfere with the ability of honest normies to replace their out of date OS with a version that is less likely to be compromised by attackers.
Are they just taking kickbacks from Google or something?
I suspect that especially banks have paranoid lawyers that probably don't understand the situation entirely, and perhaps because of that, mandate that all means have to be used to prevent non-official builds from being used, so that they cannot be sued (for some reason) if "something" goes wrong. Though I don't know if they are consistent and also apply the same reasoning to phones that don't have active security updates any more.
I feel like "the lawyers told us to do something stupid for no legitimate reason" is just one part of a bureaucracy trying to blame another part for the fact that the bureaucracy itself is doing something stupid for no legitimate reason.
While you’re correct there’s also no ambiguity about who has the final say in that scenario. The lawyers always win out.
This is objectively not true because there are companies, even banks, where this level of stupidity has not prevailed. In turn this implies that the others are doing something which is different but possible, and the scoundrel companies could be doing that too.
Even if the something is no more than engaging less fatuous attorneys.
> there are companies, even banks, where this level of stupidity has not prevailed
Yes, because that particular set of lawyers haven’t said it has to be blocked. Doesn’t mean my statement that lawyers have final say is “objectively not true”.
> This is objectively not true because there are companies, even banks, where this level of stupidity has not prevailed.
All it takes for this to happen is the lawyers not knowing.