The very fact they've managed to convince anyone that checking what OS I decide to run on the devices I own to check my own banking is any of their concern is a problem in and of itself.
It is a useful tool, but is largely irrelevant to this issue.
To the end user, this isn't really much of a difference. Whether the cause is malice or simply not choosing to use the smallest effective brush, they are still taking an action that is preventing legitimate users from accessing the service.
"Ironic" means saying the opposite of what you mean in order to be funny or sarcastic. So that would mean you think I was both polite and not an idiot.
PayPal accidentally broke support for GrapheneOS with the default settings for the app by adding incorrect anti-tampering code. It can be worked around using the per-app toggle to disable secure spawning. It shouldn't be necessary and we didn't expect there to be apps incompatible with secure spawning so we didn't originally design it to have a per-app toggle and had to add it.
Several of the more aggressive exploit protections are enabled for the base OS but are opt-in for user-installed apps. Memory tagging should work with all user installed apps but is opt-in because it's so good at detecting invalid memory accesses and uncovers a lot of bugs. Dynamic code loading via storage, dynamic code loading via memory and native debugging are allowed by default since a significant fraction of apps need those and it's not usually a bug. Users can set those as enabled by default for user installed apps which is particularly recommended for memory tagging but then people need to deal with the incompatibilities. The defaults don't cause issues with most apps so not everyone is aware of the per-app toggles.
You're a banking app. Why do you need to check my phone or my os? The security is not in what phone I use, but in how sane your 2-factor auth is and if even exists.
They have blocked rooted phones based on the error provided. Nothing to do with verification. They treat rooted phones to a level they don't with phones without critical security updates. That's the tension. Non-rooted phones aren't necessarily unsafer.
If they replaced the core of the OS with a rootkit, it wouldn't be GrapheneOS anymore but rather a derivative of it. They didn't do that and people should be clear if they have rather than calling it GrapheneOS.
Hanlon's Razor is a useful tool. https://en.wikipedia.org/wiki/Hanlon%27s_razor