I think the disabling of "secure" features will be enough of an inconvenience that people won't do this, and so mainstream apps would never bother. Some might be willing to give up ApplePay. But they could disabled FaceID as well. Or even iMessage. Whether this is "justified" or not would be a separate issue, but I can definitely see them doing it. I can see them going a step further and letting developers decide if they want to allow their software to be run on systems based on security model. Banks, for example, could simply set a flag in their app such that it will not run if the system is set to a reduced or permissive security setting.