Banks detecting root devices is a bit disturbing but then again Java script is very powerful when abused. Perhaps get a browser with better privacy options.
- Usually root detection is performed on the target device when the application loads. @acejavelin summed it up best in above comments.
I'd suggest to any reader concerned about apps probing for permissions on rooted Android to check into Xprivacy module for Xposed. This and Donkey Guard, both are fantastic for disabling or modifying access to entire features of the device on a per-app basis. Generally I prefer Xprivacy because device specifics can be forged much easier.
One short note on security with Xposed; it's not really secure. Lots of permissions and portions of processing are exposed to the device's user.
- Reporting (if any) is done over the network. While it's possible to attempt detection from the server side it's very noisy and would cause lose of trust with customers.
There's another option with root reporting, run a firewall that doesn't allow the application to report out to it's servers. Though for some this will brake functionality when not allowed network access.
- Bonus option "Advance Freeze" with ROM toolbox Pro
While the above linked options are free and nearly full featured this last suggestion isn't... but it's worth it to freeze features of an application outright. Some apps crash but most will just limp on without privacy invading features or adverts enabled.