"Real bank apps" do in fact have options to allow transfers, payments, etc. without additional authentication. They're there because, as bad an idea as they are, users have demanded ways to avoid having to enter credentials (even biometrics) every time they want to pay someone. Those of us who understand security have been saying over and over that this is a bad idea because if you can do something without needing to authenticate first then anyone who has your phone can do it too. And users still enable those options to disable the extra authentication checks in the name of convenience, all the way back to not requiring a PIN/password to unlock the phone (biometrics are no protection, the thief just has to apply a finger or scan the victim's face once and then make sure the phone doesn't lock itself before they can disable the biometrics or set a PIN/password they know).
Never use biometrics to unlock the phone, always require a PIN or password for that, and never turn on the options to bypass additional authentication when accessing an app.