Yeah it’s very hit and miss though, and potentially the bank could require strong Play Store integrity, which can only be achieved with a clean keybox file (hard to find).
With regards to contactless purchases, you’re actually better off doing it with the physical card contactless, in terms of consumer rights. A contactless card purchase is processed as “Cardholder not present”, where the seller assumes some of the liability for verifying the transaction is legit. With such a purchase you can easily argue that someone stole your card and made transactions without your permission, making it easier to claim under consumer protection laws.
This type of purchase has existed for decades and was used for catalogue purchases as well as early internet purchases. If you make a purchase with your card and PIN, or your phone with its PIN, then the purchase is considered authenticated by you and it will be harder to argue it wasn’t you. These days a lot of internet purchases are also authenticated (often by SMS or apps) but a contactless card purchase is not.
It does happen often, and it changes over time. For example, my HSBC app used to work just fine without Play Store at all, then it requried some integrity, now it requires strong integrity.