Comment by AnthonyMouse

> In the UK, the bank is liable for any transactions on your account that you didn't approve.

The question isn't whether they have to refund the money when the customer gets defrauded. The question is whether preventing the customer from using a less popular OS in any way prevents them from being defrauded.

To which the answer is somewhere between "negligible difference" and "it's actually anti-correlated with that because the custom ROM is more up to date".

Notice that requiring the attacker to use a phone doesn't do any good, because the attacker can just use a phone.