APK signatures exist and they’re enough for making sure the file you got isn’t modified. Warning people when they use apks for stuff like banking, I get, but if they wanna take the risk, it’s on them.
Blocking root makes no sense because I’d argue that if the person knows enough to root their phone and got past all those bricked phone/thermonuclear war warnings, the onus is on them to not get their keychain compromised by giving root to some random app. Again, a warning is fine.
Aside from that, people need to understand: THE CLIENT IS NEVER SECURE. NO EXCEPTIONS.
Any self respecting secure API is made under the assumption that all the calls are coming from some malicious state actor using curl until proven beyond doubt that it’s an actual user.