My online bank created an app which can be used to generate TANs or be used as second authentication factor. For the setup it asks for the screen lock PIN which I've never seen before and seems like a bad idea (the equivalent of running an application not only with
sudo, but entering the sudoers password into the application on Linux which I'd never do and alert the distributor of the application about potential malware).
Is this comparsion approximately accurate? And thus the use discouraged, maybe even requiring to take the app down? I could ask the app author, but they'll likely provide a biased argumentation.
I verified with the bank's customer service that it requires the screen lock PIN.
I'm using Lineage OS 14 based on Android 7.1.2 with Google Apps installed.