PinePhone Pro [GNU/Linux smartphone] has been discontinued

This is a bummer. If there was ever a time this sort of device was needed, it's now / in the near future when Google (probably) starts requiring all Android apps to be signed by approved developers and further locks down the Android platform.

I kind of regret not buying one of these instead of a Pixel 7 but, unfortunately, I'm pretty tethered to the Android ecosystem at the moment.

You say that, but they're discontinuing it because they didn't sell enough of them. It may be the device we need, but it's not the device we're buying.

I'll buy them once I can access all of my banks on it, that is literally the only thing holding me to IOS or Anroid at the minute

NB: Attestation has no security value here because if the phone isn't compromised then the owner having root isn't a security problem and if the phone is compromised then the user is entering their bank login into a fake scam app that doesn't require attestation regardless of what the real one does.

But because the banks that require this are cargo culting some nonsense, they require iOS or Google Android but don't really care how old the phone is. Which means you can transfer your cellular plan to the phone you actually want to use and then just keep your existing phone indefinitely to run the bank app over WiFi or tethering.

What is protecting against another app on a PinePhone from stealing your bank's authentication token?

What's protecting me when I do online banking in the browser, which I can do using more or less any device? The answer is that targeted attacks against the average middle to lower class individual are rare enough that there are far more worthwhile things to worry about. Such as the vast majority of banks (at least in the US) not supporting hardware tokens.

>What's protecting me when I do online banking in the browser

Modern operating systems will protect the cookies from being stolen from other applications on the system.