So to use paypal you actually have to reduce the security of the phone?

As with all things about security — it depends on your threat model.

It reduces security of the app itself, but doesn't affect security of the phone by much.

Not too surprising. I usually have to reduce my browser security on the rare occasion that I access PayPal via the web.