There are no laws requiring remote attestation.
If you're dealing with a legal oligopoly then it is expected that the quality won't be so great.
(The thing that banks are afraid is malware spoofing the bank app's UI and the user then approves a fraudulent transaction... not sure how to prevent that tbh)