1. No Root
2. No Bootlocker unlock
3. No Custom ROM
4. Needs Google Play Service
5. Needs to be installed via Google PLay Store
6. Needs my phone number
7. Needs that SIM in that phone
8. Needs that SIM in that slot
9. Needs location
10. Works only via Mobile Data
11. Developer options disabled
12. Needs someother app to be uninstalled
13. Disable VPN (Firewall apps use that)

So for bank stuff to need a seperate phone, other for whatsapp (and other spyware) and then your main thing. And when you go out people ask questions.

I don't understand my apps are developed with their security dependent of the OS, why can't they make secure apps

Because the priority is not making secure apps, the priority is not being responsible for security incidents. The lawyers at the company making shitty apps (e.g.: your bank) want to be able to say "We followed industry best practices, which is whatever Google said to do".

That being said: root, unlocked bootloader, and custom ROMs can all be big security problems. But if your bank's app will not work on GrapheneOS, your bank just sucks.

I have a degoogled phone (LineageOS) and I was able to get my banking apps working by isolating them in a work profile using Insular and also putting MicroG and Aurora Store in there. MicroG tricks the apps into thinking you are connected to Google Play Services. IMO its better than having a 2nd or 3rd phone.

It is hit or miss with app updates, I don't mess with bank stuff breaking randomly

If at all possible use PWAs or apps like Hermit or Alpha, as to minimize the tracking of banking apls and the like. I am aware that some banking apps allow for better features but there is no reason why anyone should be using social media apps, use PWAs.