Malwares can possibly do that even on non rooted phones if a privilege escalation attack is possible. And just yesterday, there was an article here about exactly one of those.

Also I highly doubt that there is any real statistics anywhere about whether this is a real threat or not. I guarantee that nobody did such statistics properly. The only known data is from companies which sell root prevention tools, so totally unreliable. And internally I guarantee, that no banks collect such info.

So no, banks lie about this only because they can sell this to judges as safety feature, when they fuck up, which happens continuously.