This is a good point. The bank needs to do as much as they can to reduce fraud risk, and they've probably found some correlation between rooted phones and a higher likelihood of fraudulent transactions. Some banks block VPNs for a similar reason - when logging in from a VPN, it's harder for them to tell that it's actually you vs if it's an attacker that uses the same VPN service as you.