I suppose he is referring to banking apps (and all security-critical apps) relying on Google and Apple for attestation of device integrity (i.e. that nobody, including you yourself, tampered with the device operating system).

This almost surely could be solved with open-source, public-owned code, although I’d have to research that to be sure.