Happened to me. Stopped working on GrapheneOS because of some goddamn check they make, but still runs on an outdated /e/OS signed with the Google test keys (i.e. without a proper secure boot).

The real fight is to prevent companies (like those banks) to do that kind of shit. And to force manufacturers into allowing us to install alternative systems, instead of preventing unlocking/relocking of the bootloader for instance).

Yeah, and legislation would be needed here but that's just not going to happen. With the GrapheneOS Motorola partnership (only a Lenovo subsidiary but its something) and hopefully more with other manufacturers, this might turn the tide, but its a long shot.