IIRC some root detection mechanisms still check for an unlocked bootloader.
This is handy if you only need root occasionally, e.g. Titanium Backup, and don't mind messing about in TWRP.
With that said, I highly question why any banking app would check root, mine doesn't and it seems to me like even if it did I could still use their website on my phone while rooted or my Windows machine with no sandboxing whatsoever. Requiring it just for the app seems pretty damn pointless.
At least all German banks have to have an open API for transactions, and I can run my transactions with curl if I wanted to.
A banking app shouldn't care about how I run it, otherwise I'll just throw it out and use one of the open apps for HBCI.