No, I'm not assuming people are using a Google wallet.

Most businesses only release an android package via Google's PlayStore. ("Download our app via PlayStore.")There's no reason a bank couldn't host their .apks on their website (if you're unfamiliar with the .apk extension imagine it's a .exe: you click on it and a program runs; an .apk is to Android what an .exe is to Windows). To download packages from Google's PlayStore requires a Google account. Google demands a few things from these two parties: publishers need to pay Google a fee to have their .apk hosted by Google and users need to run Google's spyware in order to access those .apks hosted by Google.

It's often stated that if you want digital-freedom/privacy use GrapheneOS (if you have a compatible Android-device) or use a linux mobile-phone. To which most users respond: but my bank app doesn't work on those platforms, therefore I won't use either GrapheneOS or a linux-phone.

The bank app won't work, because Google's spyware is not included in GrapheneOS (a point of GrapheneOS is to avoid such spyware). Because GrapheneOS (or linux) doesn't include Google's spyware Google will do its best to block such devices from accessing Google's PlayStore. Such computers are violating Google's demands: if you want access to the PlayStore you have to run Google's spyware.

Even if you were to get the appropriate .apk by avoiding Google directly (perhaps a friend who got it from Google then passed it to you) the bank's .apk would fail to run on a device free of Google's spyware, because you're not capitulating to Google's demand: you didn't get it from Google's PlayStore and the 'app' knows that by the lack of Google spyware. (Google's spyware and the bank 'app' talk to each other. If the app can't talk to Google's spyware it will halt.)

Therefore if a bank only has an 'app' to interact with that bank is saying: you have to download it via Google's PlayStore--which necessitates a Google account and running Google's spyware. Therefore if you want to use banking 'apps' you need to enable Google's monopolistic, spyware practices (you have to enable the corporations to practice surveillance-capitalism). Google defends this practice often with security-theater ("Google says it must be done this way for security.") when in reality it's about entrenching a market monopoly.

This is absolutely removed and I do deride users who say they want computing-liberty and -privacy, because there are banks who still have usable websites. You don't have to bank via an app. If you do bank via an app you do so with full acknowledgment that: a) you're rewarding anti-competitive behavior; b) you're entrenching Google's monopoly over Android; c) you don't actually want computing-liberty or -privacy.

It's piss easy to change banks. It's impossible to stop Google. If you want privacy you have to ditch Google, which means banking with a bank that allows you to bank via a desktop-computer (via a website) or in-person through bank-branches. If the only way to bank with your chosen bank is via an app that then means the only way to bank with your chosen bank is by enshrining Google's monopoly into your life.

Passkeys are a completely separate thing. They're an increase in security for all users. Users are frustrated by 'big tech's' increasingly monopolistic practices and instead of doing anything practical (like not running those particular pieces of software) they've latched on to decrying passkeys, which the majority of the commentators are actually clueless about. They're just seeing those 'big tech' companies forcing yet another change onto them. They're lashing out against their lack of power. They're lashing out against their subjugation by 'big tech'. That they're being forced to use "passkeys" when they don't even know what a passkey is.

Passkeys are an open standard. They're not entrenching anyone's monopoly. Increased security is desirable by all parties (corporations, governments and individuals). Passkeys enable that. You're not locked into Google's Android, or Microsoft or Apple. People are under the assumption they are however.

I could host my own website using passkeys as the method for authentication. No big-corp involved. Offline. Spooky. Big-passkey is coming for you.

That probably left you with more questions than answers...