> In fact it may be a good measure against it since you quickly see that it does not open in your usual app

There's nothing preventing a bad actor from copying the existing banking app and attaching a backdoor, assuming local code execution capability - either re-sign it with a local codesign certificate or use runtime code injection/linker overrides.

A web app has always the URL bar and the banking site can rely on HSTS to prevent man-in-the-middle attacks.