Strange, Onion routing was already enabled for my domains. Sounds like at some point it became an opt-out feature, not opt-in.

A banking app allowing itself to run on rooted devices isn’t a security issue.