It’s easy.
Banking app + TAN app on 1 mobile = no go
Only a few years ago, the banks forbade sending the TAN to the same device and banks were not liable. In 2020, convenience is suddenly more important than safety?! 2FA can be cracked if the transaction is carried out on the same mobile, regardless of what banks say. Android’s security has never been fundamentally improved. Every new version comes with tons of new bugs and only current devices get security updates at all. Aliendalvik on SFOS does not even receive all the necessary regular security patches and works with an outdated version.
If you want to be at least a little sure, then use an independent TAN procedure, named as ChipTAN, Sm@rt-TAN or CardTAN with an external TAN generator. Sure, it’s inconvenient, but better than nothing. If your bank doesn’t offer this, find another one.