Mobile banking apps rely on tools such as HTTPS and sandboxing to keep safe, but operating system vulnerabilities may render such measures useless anyway.